Yes access profiles would make sense here, if there is no approval workflow then this can also be auto-assigned through the Identity Profile based on lifecycle state. If there is then simply configure this on the AP.
If you plan on grouping these in Applications, then be aware that this can be a bit frustrating as each edit on the application triggers an Identity Refresh which while running, you will not be able to edit any Applications.
You’re right, Roles are better suited for auto-assignments and it can create a poorer user experience but this can be mitigated with proper change management. Consider running a pilot with a small group of users testing both approaches, this way you can get user feedback and also experience first hand what might work best for you and help you plan ahead for potential future role modelling.