Hi @eias , For direct means do not give those staff accounts permission to themes in the admin it is as simple as that.
Otherwise you need to create and setup staff accounts with email addresses YOU control.
That way it doesn’t matter if they export the theme is goes to an email you manage and all they have is the email and login for the store and not the password for the email account.
Alternatively you setup virtual machines and administer the whole process so they don’t log into the admin but you do and what they log into is a remote desktop session under your control.