Although I can't comment on your individual use case, it's better to enable remote error collection using something like Sentry or BugSnag. Both also support integration with other languages, such as JS, which is very handy when tracking down front end problems. There are lesser alternatives such as New Relic error collection (which ties in with their APM) and plain ol' email, but these are both considered obsolete these days.
To answer your original question, I'd strongly advice against selectively enabling debug, but if you insist then you'd probably want to do it inside middleware. Naturally any errors that occur before the middleware is loaded won't get caught and will display the standard 500, and this could include quite a few different problems (e.g. Db connection failure). If any libraries/modules cache the settings.DEBUG property prior to the middleware being called, then this may cause some weird edge cases. Another alternative is to do is based on IP, but again this is extremely bad practice for production.
Hope this helps.
I'm writing an app where it'd be super helpful for logged-in users from my company to see error pages and the like as though the app was running with DEBUG=True, while still preventing ordinary users from seeing that output. I see that the docs strongly warn me against changing settings at runtime, so I was wondering how I could achieve the same effect?