To prevent general users from accessing the Sandbox instance while maintaining their access to Production, the administrator must use Security Groups. This is the standard architectural method for environment isolation.

1. Microsoft 365 admin center: You must create a Security Group (or use an existing one) and add only the authorized users (e.g., developers, testers) as members.
2. Dynamics 365 Sandbox instance: You must edit the instance settings to associate it with that specific Security Group. Once a security group is assigned to an environment, only users who are members of that group can access it. All other users (including those recording data in Production) will be denied access to the Sandbox entirely.

Microsoft Learn, "Control user access to environments: security groups and licenses", Section: Associate a security group with an environment. Available at: https://learn.microsoft.com/en-us/power-platform/admin/control-user-access

Microsoft Learn, "Create and manage environments in the Power Platform admin center", Section: Security group. Available at: https://learn.microsoft.com/en-us/power-platform/admin/create-environment#security-group

Microsoft Learn, "Manage user accounts, user licenses, and security roles", Section: Security groups. Available at: https://learn.microsoft.com/en-us/dynamics365/customer-insights/journeys/admin-users-licenses-roles