Hi Salvatore,
In your case I do not think the first option is interesting, because it will just end up in the COFC error pool.
What you need is to stop users at the entry point. If that is a web interface the question is where the WBS drop-down list is coming from. Is it directly from SAP or some other system where data comes through interface and you can filter that before it is available for users.
If data comes through interface, then you can filter the flow from SAP to web app based on certain criteria that can be a user status (again).
Regards,
Paulo