I was wondering what would be the correct deployment workflow for customization under AX 2009. For AX 2012 I found a nice whitepaper Deploying Customizations Across Microsoft Dynamics AX 2012 Environments .
But this doesn't help much because with AX 2009 there is no concept of model store deployment (unless I'm mistaken).
Are XPOs the way to go with AX 2009? If someone could point me in the right direction this would be great.
XPOs can and do work, but there are some issues using them. From most of what I've researched, when it comes to SOX compliance the best way to migrate code changes is by moving the binary server files - the .aod, .ahd, etc files - that are stored in the application directory of the server. Since these files are the compiled versions of the application code, it is easier to prove that the modifications that were created in a development environment are the same modifications deployed to the production environment. XPOs are plain text and can be manipulated in a text editor, making it more difficult to prove this, though not impossible.
I actually did a writeup of what we have done to manage our code deployments if you are interested. It covers XPO vs Layer file migrations, and ultimately describes our process for automated builds and deployments. Since we put it in place our auditors have been very happy when it comes to auditing our system.