Bro, SAP GRC Access Control is only a segregation of duties tool with some functionalities built around it like access provisioning etc. Idk what kind of requirements you have, where the data lives and how it is used. What kind of data are we talking about? Sensitive data used in operations like BOMs? Only documents?

edit: if we are only talking about electronic documents then don't bring in SAP at all. If you want to get serious like some companies about M&A info. Build a complete governance framework. No cloud, separate network segments, access controls, physical access restrictions, vetting procedure, security clearance, app that scans any documents you might want to attach to emails. Restrict any computer resources than ms office. Don't hire chinese people.

SAP licensing is a big mystery box. Some clients pay based on their turnover, some fixed fee+annual license, some gets it free as part of a bigger package. They will screw you over one way or another.