Sue:
You can certainly do that as it would be an ABAP system, however, adding CUA to the mix adds a good level of complexity to your environment. My recommendation would be that if you don't need to have it attached to CUA then don't.
The use of CUA and AC really is a duplication of effort and in most cases, I recommend the sunsetting of CUA as from an End user standpoint, it makes no difference on how the user creates the request, but from an Administration / System side adds maintenance that in the end would not truly be necessary.
In the end, it really is up to you to determine the best route, but I am of the school that with Access Control, CUA can become totally irrevelant.
Cheers,
Kevin