How to prevent Devel module to be installed on production environments
Method: Drush


Drush can ignore the enabled states of extensions when synchronizing configuration.

drush cex --skip-modules=devel

drush cim --skip-modules=devel
With Drush CMI tools you can operate with a list of configuration to ignore.

drush cexy --ignore-list=/path/to/config-ignore.yml

drush cimy --delete-list=/path/to/config-ignore.yml


Method: Modules


You can use the Configuration Split module that allows you to:


Split off some configuration to dedicated folder
Blacklist configuration
Ignore a set of configuration
Configured by configuration entities 

Configuration Read-only mode module


  This module allows to lock any configuration changes done via the
  Drupal admin UI. This can be useful in scenarios where for example
  configuration changes should not be done on the production
  environment, but only on staging or local environments.


$settings['config_readonly'] = TRUE;
And another module is the Environment Config that allows you to override configuration on a per-environment basis.