We are getting our feet wet with DevHub. It seems that for our developers to be able to use it we need to give them accounts in our Production org. However, our developers are outside contractors, and we cannot give them access to Production data. Can they use Salesforce DX and scratch orgs without having access to Production? Or is there a license that we could give them that lets them use DevHub without getting access to Production data? Or can we use Permission Sets? How is this situation best handled?