I want to establish a workflow where all content changes and Wordpress updates are exclusively done on the staging website. Neither my clients nor I make changes directly to the live domain ever. This is to prevent any crashes and costly downtime. My plan is to manually push the staging environment to live on a monthly basis.

For updates, I want to use SafeUpdates. However, the current issue is that SafeUpdates can only run on a live domain. This contradicts the entire workflow I want to create, as it would lead to conflicts when pushing staging to live. To avoid this, I want SafeUpdates to run exclusively on the staging environment. The result would be that all updates and modifications are made on the staging environment, keeping it ahead of the live domain. I would then manually push staging to live each month.

Ideally, with this workflow, there would also be a button to easily remove or hide all WordPress login functionality from the live domain to prevent any logins there, since all modifications and updates are done on staging.

TLDR: Add safeupdates to Staging, and idealy add a button to disable all WP login functionality on live domain