Hello Kir Chern,
Here are the answers:
1. For all the three systems central, sender and receiver you need RFC users with the role assigned
SAP_TDMS_RFC_USER_700_CR. Dialog user is required only for central system. You need to assign the role SAP_TDMS_MASTER_CR to the dialog user for central system.
2. Roles mentioned above are enough for executing any package like BPL, scrambling, HCM etc. HCM package activities will take care of restrict access to sensitive data that means while executing the HCM package you will be asked to activate more logon switch.
Hope it helps.
Thanks,
Anita