How do we segregate duty and ensure deployment to PROD is only available to admins?

Using Atlassian Bamboo you can configure which user (or groups of users) have permission to deploy to each environment. Please see the relevant documentation here.