Let me start by saying, using the Default environment is like using a giant garbage can that you just let anyone throw recycling, garbage, real trash, food in.
That's not meant as a mark on you, its silly that the default environment in fact let's you do whatever you want, UNLESS you put specific policies in place.
So yes,
you should have either
1) a Pipeline build out that has approvals, but you'd always want to have build in regression testing as part of it to succeed before approval
2) build your own customized pipeline using GIT actions to verify code changes.
I will say, that from a governance perspective, I am certain you realize this is a huge wide net, not something that is a quick checkbox.
You are absolutely thinking correctly about this and I love that, you just have to choose which process you want to follow.
I would personally have
1. Dev environments
2. Push to Test for Validations
3) Push to UAT, where you have at least some real production data (even if you've changed it), to again make sure it works in the real world.
4. Then production
In each case, it requires testing validation and sign off
You got this !!
