Statutory Audit Compliance for critical databases

1. We need to capture old value and new value for each change in a business transaction in a database (versions ranging from 9.2.0.7 to 11.2.0.4) and retain for 8 years for forensic purpose
2. We need to block some userids from logging into the system directly using any tool sqlplus , TOAD etc. but should be used only by the application.
3. DBAs should not have control on business data but should be able to handle day to operations effectively.

Kindly suggest tool for enabling these audit requirement . Suggest even if there is any third party tool also.

Will Database firewall and Audit vault help compliant to above rules.