The best option for you would be TMSAUDIT that can be found in your CTAPJCL library. Run TMSAUDIT for TYPE 0,1,2,3,4 and FORMAT=LONG for the time frame for when the users had UPDATE access. Once you run the report, you can review the type 0 record as that tracks batch updates such as TMSUPDTE, ISP, and TMSUDSNB.