Hi,
there is a similar thread here[1]
First your question about URL parameters, your analytics scripts will run in the browser and send any data to GA from there, so the request reaching the server should not be required. Unless you are doing some processing server side?
There are two ways you can handle request parameters in your scenario:
1. Deny all parameters. Then identify those parameters used by your codebase and only allow those through. In this case, your marketing team can add whatever they like without it affecting the publish instance. You client side analytics code will send all data to GA. In this scenario, your development team need to be disciplined and be aligned with devops.
2. Allow through all parameters. Identify those parameters to be used by you marketing team and update Apache/dispatcher to block them. Low development overhead but you need strong governance between your marketing and WCM/DEV teams, otherwise the marketing team could bring down your publish instance.
Regards,
Opkar
[1] http://help-forums.adobe.com/content/adobeforums/en/experience-manager-forum/adobe-experience-manager.topic.html/forum__hjr6-dear_all_dispatc.html