Sorry to say it's very unlikely for this to work.
The SP_SETAPPROLE is a cornerstone in the Dynamics SL security design. Every time the SL client launch, a call to sp_setapprole would be issued early on, except for those within the ADMINISTRATORS group. Since you already granted SQL's SYSADMIN role, in your case there's no need for the sp_setapprole call, but the SL client doesn't know this. And I bet the ADMINISTRATORS waiver is hard coded.
Since SQL's Application Roles are database-confined, it make sense that changing databases won't be allowed after the sp_setapprole.
Yo may try to build a set of scripts to create and assign users. If you use integrated security, you can build a set of powershell script that combines Active Directory provisioning with SL user creation. Probably, the auditors will be appalled to learn you can script the hell out of SL.
I work in a stock-listed company myself. The auditing firm probably seeks a separation between business-owner and system-owner. Dynamics SL just doesn't come with that. What we do is scan all accounting records looking for the crtd_user and go hunting TI profiles.
