SQL Server 2016: Granting security to do everything but read / write data We have an offshore support team coming online to support our servers as DBAs for 24x7 support.  However, there are several instances that have a limitation due to contracts that limit offshore access to our data.

What security needs to be added to give them effective control over the servers as DBAs, but limits them to not being able to read/write data?

The instances are in mixed mode, but it would most likely be applied through a AD users group.  SQL Server 2016 and Windows Server 2016.
It is not possible. Everything includes granting access, which means they can change whatever access you give them. 

There are some encryption methods that can be used so DBA's can have full access but not have readable access to the data. I believe Transparent Data Encryption (TDE) is one option, but I am not an expert on it.

Make a list of "everything" you want the DBA's to do, then look at the rights required to do that. IMHO, a DBA who does not have sysadmin, is not a DBA.