How do you configure your Serverless setup, Github and AWS such that you are secure from 3rd party developers

tldr: Can I set up dev/staging/prod in a way that secures my code?

I am fortunate to have a very talented off shore developer but he is in a part of the world where we need to be careful. It’s not a reflection on him but his circumstances. Any way, I would love to set up the whole environment such that:

*** Only I can push main branch to the production lambda instance **

Are there clear and plain settings in this platform that controls which branches of code go to which lambdas and how do you control that? If I control the main branch using GitHub permissions, can I restrict a lambda instance to that branch only using this server less platform?