Disclaimer This is solely based on my experience. I'm sure there are others who will have a radically different experience with trying to get good UAT feedback.
Note I consider UAT to be more informal than formal. I'd love formal UAT, but there simply isn't budget for that where I am. :-(
Unfortunately, in a situation where SOX compliance is involved, you're likely to have (by the nature of people who are going after SOX compliance being large companies) many layers of separation between you and the users.
For example at my firm (a multi-national manufacturing firm) we have developers --> dev manager --> Business Analyst --> Manufacturing plant manager --> users (and sometimes, there's a layer between the users and the plant managers.) I can't imagine yours is any different.
You simply have to take what you can get. You won't get 1 on 1 time from the business side. That time would have to be allocated by the development time. They might be willing to spare an hour of some order-entry person's time to show you how they're actually using the application, but they're certainly not paying for a developer's time. They have a plant to run, and you software-people already cost them too much money. (That's actually how they see us.)
I think it's safe to say there is no "normal" for UAT. You have some companies that make it a big deal. They get focus groups, they get feedback, they do surveys, provide incentives. You have others where it's simply not a big deal at all. They really don't care as long as it's "doing the job." They define doing the job as "the people using the software haven't complained about it."
The smaller the company, and the smaller the userbase, and the more public the userbase, the more UAT will probably be involved. The larger the company, the easier it is to say "You want more? Well, that's too bad." Same with having large userbases - you don't care if a couple leave. It's not worth the time compared to bringing in more people with new features. If you have a public userbase, they have more of an option to switch to something else. If it's in house software, they don't have much choice, so development has more power to just shut them down.
Personally, we would love to hear from our users, even though we fall into the category (by my criteria above) that can abuse them the worst: large ($2b+) large (7k+ users) private (in house). It's actually not us, but the layers of management in between that obfuscate the true feelings of the userbase, and the results of any UAT.