SQL Server 2016: Granting security to do everything but read / write data
It is not possible. Everything includes granting access, which means they can change whatever access you give them. 

There are some encryption methods that can be used so DBA's can have full access but not have readable access to the data. I believe Transparent Data Encryption (TDE) is one option, but I am not an expert on it.

Make a list of "everything" you want the DBA's to do, then look at the rights required to do that. IMHO, a DBA who does not have sysadmin, is not a DBA.