I think a good start is to have a VPN. Only within the VPN developers are able/allowed to communicate with the INTERNAL parts of your cloud for things like test, staging environment, databases and so on.

I don't know about Azure, but I know other clouds have services to integrate your VPN with their environment allowing you to directly transit between them.

Hope that it brings some kind of insight to your research ;]