What is the best way to secure UAT environment from developer access?

Developers can monitor process instances of their application but should not able to edit anything in UAT.

Deploying application/package/plugins from UAT to PROD.

Creation of new users and adding them in respective groups

Editing of process instance in monitoring mode