is it a good practice to ip block dev/test app servers from production database server? I would like to do this as somewhat of a last line of defense as we will be replicating production to test regularly.  Is this good practice?
Not only is it a best practice, it's mandatory to any major compliance requirements such as PCI V2 &amp; V3, SOX, and almost any auditor will ask about it. Yes, having them on the same network is asking for major problem.  

Page 5 of the PCI DSS V2:

For example, there must be a clear segmentation of functions and segregation 
of networks with different security levels; segmentation should 
prevent the sharing of production and test/development environments; 


Page 32: 6.4.1 Separate development/test and production environments.