EDIT: I have taken out the majority of this post.
Start packaging receipts with an AppleID you control and control your users access to MAS and keep on top of updates.
Academically it's useful to know you can use information from these two posts to get .pkgs out of the MAS so I have included it below, but DO NOT try to use this method to distribute MAS apps to end users.
Read Rich's original post:
http://derflounder.wordpress.com/2013/08/22/downloading-apples-server-app-installer-package/
My small post describing success using this with iLife apps:
http://mattzago.com/blog/2013/10/21/getting-packages-out-of-the-app-store