Hi Barry,
updating via SQL the active field is the only possibility you have but you're right saying it doesn't work, the first time you change or insert one user in the admin console the active status of all user become 'Y'.
I think this field is not intended for your purpose but when you copy or restore an appset you have all users disabled only the sysadmin works so you're able to do the checks and activities you need before to open the appset to other users.
That's why I suggest the other options.
Regards
Roberto