In the past I have used IP restriction on the infrastructure side of things to get this done. Restricting PROD access to application, software management and SQL machines. But this is a nice way of doing it all in SQL.