I want Theme developer to have admin access to WP but not civicrm, is that possible?
I wouldn't hire an IT person who thinks it's ok to do  development on a live site. You always do development and testing on a COPY of the site. See also https://codex.wordpress.org/Running_a_Development_Copy_of_WordPress

One of many reasons is that the dev copy can have fake or anonymized data in it - I assume your concern is the devs seeing the real data.