I have a production org that is the Devhub. I have a full copy sandbox. I want that the developers that are working on their respective scratch orgs, don't deploy their changes to production directly. I only want them to push the changes to the sandbox. Is there anything I can do in the SFDX process that can prevent someone from deploying directly to production/devhub?
Make them a "Read-Only" or "Minimum Access - Salesforce" user, and then grant additional permissions for them as you need to (via a Permission Set). You can follow the Add Salesforce DX Users instructions in the Salesforce DX Developer Guide. A properly configured Developer Permission Set can include just the permissions needed to create new Scratch Orgs, new Sandboxes, etc, without any rights to create, read, write, or delete any other objects in the system, and have no System Administrator capabilities in the Dev Hub org.