First of all, don't grant access the individual developers. Grant access to roles or Windows groups. If you grant the exec etc access to a role, all you need to do in the restored database is to drop that role. Poof, permissions gone. There could still be a role that gives the developers membership in db_datareader.

You should spend to much on effort on this part, because you will only copy from test to production once. You may copy in the other direction more often, though.

I'm assuming here that you are using Windows logins. If you use SQL Server logins, it is all a lot simpler - don't add the logins for the developers on the production server, but give them other logins.