How to restrict access to PROD env

It seems there are similar threads on this topic, and I am not sure how others are handling this scenario, as this seems very basic in terms of environment segregation between PROD and Staging/Sandbox.

No matter how careful developers can be, we really dont want them to inadvertently run any Update or Insert queries in our PROD database, while editing/creating an App.

How can we just restrict them to staging environment, and not even allow them to see the PROD instance of the db resource.

Thank you,