Your actual business data should always sit in the Production Environment. Default environements generally provide access to all the users with default role and in production environemnt, you can always map the users with security roles before mapping them to the environemnt.
You create a production environment and deploy the solution here with appropriate role accesses after configuring the CDS database.
If this reply has answered your question or solved your issue, please mark this question as answered. Answered questions helps users in the future who may have the same issue or question quickly find a resolution via search. If you liked my response, please consider giving it a thumbs up. THANKS!