A central hub of Azure cloud migration services and tools to discover, assess, and migrate workloads to the cloud.
Yep, AFAIK, your understanding is correct. Once replication is configured, the target subscription and region are locked for both test and final failovers. Considering that you cannot perform a test failover in one subscription and the final cutover in another, your proposed workaround (configuring replication twice) should work in order to maintain strict environment separation.
You do not necessarily have to push all the data twice over your network. You can avoid lengthy initial re-replication by leveraging your existing replication appliance or Recovery Services Vault configuration if orchestrated properly.
Make sure you run Clean up test migration after validating in the Sandbox subscription to delete the test VMs and temporary resources. Depending on your environment, you may also replicate the VMs directly to the sandbox, perform final migration, and then utilize the native Azure resource-move capabilities to move the production-ready VM to the Production subscription after it is running in Azure.
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin