Fernando,
When you remove the SAP ALL profile to the users , what generated profile they have now?
They should have at the minimum of display access roles. Aren't they have any other BW related roles?
Did you try to create any BPC BW Specific roles to the BPC users to isolate them from the BW users/developers?
My guess is if you follow this method, you will not have any role/profile conflicts and it would be easy to manage security in the front end.
Hope this helps..