How are you licensed today: by appliance/service or by throughput?
How do you plan to deploy this pre-prod environment? Are you going to stand up a completely separate stack (head unit, ESA, Concentrator and Decoder) or are you just going to spin up a virtual ESA, Concentrator and Decoder and keep the rules separate from the Production system?
How much data will you be sending through this pre-prod environment? Are you planning to just send maybe 1 GB of test PCAPs/logs through that system to test rules or will it be getting a full copy of the network traffic / log traffic that your prod environment gets?