How to prevent group from deploy to environment but allow same to redeploy?
You can add a post deployment aprroval to the dev environment that the dev team has to approve.
And then you can add a pre deployment approval to the QA environment that the QA team has to approve.

Then a release will be automatically triggered for the QA environment after the dev team has approved the post deployment approval on the dev environment. But it will not deploy to the QA environment until the QA team has approved the pre-deployment approval.

Additionally, the QA team can re-release any previous release to the QA environment at will by going back to the release and clicking redeploy.