I believe that when you purchase an Enterprise license that you also get some tokens to setup a Test or Dev environment.
You should be doing all of your development work in this Test environment and would have a limited number of users (developers, testers, etc.).
Once an app passes QA then you export it and publish it to your Production environment where end users would have access.
You could also have a 3rd environment (Prod, Dev, Test). We have that. We use Test to load the latest version and test our apps there. Once approved then we update our Dev and Prod environments. Don't know if you would have to buy some tokens for this Test environment or if Qlik would just give you a few.