My requirement : I want DX User to be able to access only Dev-Hub/Scratch Org and Name Space registry. On the Dev-Hub, this user should NOT have ability to create records on any standard/custom object. If DX user uses Standard User profile, the user will still be able to create Standard Object records which I do not want.
I can achieve this my creating a new profile directly in production org restricting access to standard objects. But I wanted to do it through Meta-data deployment that goes through CICD pipeline. Since Dev-Hub is not present in lower environment sand boxes, I may not be able to do it through metadata deployment.
Can someone help me to achieve the functionality in first paragraph in a better way?