I would not be considering to use BI/PWS UVMs for EPM at the moment, Why not just go with the PM Cloud solution. there are so many benefits to use the PM Cloud instead.
Upgrades.
Client maintenance.
New features.
Integrations.
Just-In-Time.
And so many more.

The maintenance work of UVMs is just heavy, adding the EPM components just adds more load.

Beside the PM Cloud can easily integrate with Password Safe, without having to add all the EPM Components to the UVM, if you do have PWS On-prem already, you might just need a UVM SQLFree in the DMZ for off network password rotation.

Again, PM Cloud would be my recommendation.