No argument there if you wish to spawn on access, or just use a frozen image with COW.
However, you failed to read, or at least quote the one line that makes this relatively possible...
It sounds as if this is intended to be on an "infrequent" and "exception" basis.
In other words, allow them to do what they need to do, up to the point it becomes a risk, and then step in. I mean, really, if you have people with a legitimate need to download that much to do their jobs, is it not possible that you may have a poorly spec'd image for your systems?