*PUBLIC *EXCLUDE on Libraries

I am trying to move to a an environment where libraries are set to *PUBLIC
*EXCLUDE.

My problem is that both IBM supplied profiles and our own profiles both use
QDFTJOBD for a job description.   QDFTJOBD, in turn, uses *SYSVAL for the
initial library list.   *SYSVAL is setup with libraries needed for our
production ERP package.

When attempting to make the libraries *PUBLIC *EXCLUDE, I get hit with all
the IBM supplied profiles that now need to be granted access to the
libraries.   I wouldn't mind adding the group profile needed for this, but
apparently IBM supplied profiles cannot be modified to have supplemental
groups (I get 'CPD2201 - System user profile cannot be changed' when
trying).   Neither can they be changed for *JOBD.    

Does this mean that I need to create a new JOBD, and move all of our own
users over to it?   I don't relish the thought of making all those changes
manually.   IBM supplied profiles would take long enough, but our own user
profiles are much more numerous.   Is there some creative way of handling
this?

Either way, what is the minimum set of libraries needed?   For the multitude
of ODBC connections being now being made I'd like to limit the user ids to
one library of special files to be read or updated.   Would they still need
access to QSYS, QSYS2, QHLPSYS and QGPL?   

Any advice would be appreciated.