If you were to look at the 1600 users and simulate the imparting role instead of the derived roles, how many different combinations of access would you have?
You might find there are 20 different access combinations and can simulate them. That will show you which combination has violations? I'm assuming the users do not have other access in Production already active.
If these are new users, you can lock their account but change the validity to today's date. You can then run risk analysis and they cannot login. Only works if new user.
Regards
Colleen