Mitch, what I recommend below is not supported by PTC, always try on a cloned sandbox or backup Training in full first.
The problem you face is not all that different to how divestures are managed.
The best route to handle this is:
LDIF syncronization
Database synchronization (presume you know how to use SQL to isolate differences)
Absent those skills required to achieve the above, find someone in company who can help in that capacity. On overlap, it mainly is ensuring per database table entries, ensuring no overlap in the ID2A2 or derived from foreign key columns. A good DBA can do this very quickly and easily.Othern column names, this is really a generic task and not speciifc to Windchill. I use it all time in data migrations. Classname and numeric ids make this quite easy and WinDU capitalizes on it or had in the past..
On new systems:
Proper change ad configuration management, deploy users people subsection as LDIF file, not full LDIF file; disallow product, library and project team administration by end users. Place groups in each role instead. Promote configuration from server to server in a less manual if not completely automated fashion.
Before any data is added, create "Z" tables as duplicates of fresh system. Copy all tables as duplicates appending a letter Z to the front so as to make them appear after all real tables, and always have them as a backup to revert to.
I also always did this for testing PartsLink implementations and being able to rollback system without loss of any other functionality. Being a programmer to know the relevant database tables is useful. Not supported by PTC of course.
On existing systems:
I almost guarantee, most users on the community forum have never done suggestions that follow. It's not difficult, just out-of-box thinking. Even PTC internally is likely not used. An opportunity to share - grin.
Synchronize unique user/role/group configurations. Where training server users are unique, for them to a new repository defined in WindchillDS. This is challenging for average folks, but is extremely secure, as the accounts are inaccessible on production if the repository is inaccessible from your Apache, IIS, Nginx, or other http web server. Keep in mind, method server sees them as normal users.
After synchronization, migrate to strategy advised above under new systems. , Ensure all users, groups, organizations, and other settings, are maintained on both servers. Make passwords different. Create users first in Windchill DS, then link in Corporate directory. This of course, can be an issue depending on user quantity. If that is an issue, feel free to reply and let us know.
Now users can be disabled/deactivated, you could just port over the UNION of the WTUser(s) where there are no problem ensuring in database comparison differences, the key references for equitable rows in other database tables are connected.
A reverse rehost of training to production, IF production has not gone live. If it has gone live, do not rehost, edit the training servers' (all) reference to not resolve to production IP addresses for production hostnames. Clone production. Copy to training. Access by end users for the moment requires a similar procedure on laptops, tablets, workstations, etc. You can even make prodution file vaults read only and keep them connected in training, test, etc. without duplicating content. New content going to a system specific vault. Isolates deltas in content. React and manage as needful.
I am not sure if you are a programmer or have operating system scripting knowledge, but that makes life easier. For example, I export LDIF from LDAP for ou=people and convert to user and group load file format if LDIF import is directly shunned. Like users of the BIF have challenges.
The training server and / or sandbox methodservers and other servers ideally should be offline in cases. Clearing all caches is a good idea. While systems are running, clearing principal cache or not caching at all.
I have been around the block on this MANY times. Not supported but very effective.
Time to complete improves per execution and the first time is data quantity delta specific.
Reply if questions or contact me directly through here if I happen to get busy and forget about the posting reply. It happens.