The target system is often inaccessible to the users. An easy way to accomplish that is to manage parameter STATUS of the user profile: disable all user profiles, except the ones of the IT team and PMSOFTICF.
The command EDHUSRENA allows you to change the status of a set of profiles.
Selection with name, generic name, *ALL
Change parameter STATUS to value *ENABLED
Include or not, Q* profiles; include or not the QSYS owners: this allows you to modify only the Q* profiles that are not system profiles
The QSECOFR profile is ALWAYS excluded, regardless of the value of the QINCLUDE parameter.