Many different ways to go about this, but I think the key is a separate catalog per environment. If you have different workspaces for Dev/QA and Prod, then making sure the lower environments only have read access to Prod (if wanting to test against actual data in order to avoid duplication) is a good strategy as well.