Your sensitive data should be encrypted in Production anyway. When that's the case it's easy, after restoring to dev you can deny access to the keys to everyone (as long as the devs aren't sysadmin, which they shouldn't be), or if you want to ensure that even a sysadmin on dev can't access them, delete the encryption keys after the restore, though I wouldn't recommend that route.