You can create multiple app policies allowing you to assign different apps to to different devices/device groups

Select the apps that you want for "PROD" devices in one policy and assign only to PROD device and Select the apps that you want for "UAT" devices in another and assign to UAT,

You can also assign to single devices if required 

Each Managed Google Play account for an enterprise binding give one separate private app store for the devices enrolled with the binding.  Thus, in order to have groups of devices deployed with apps not visible by other groups,  each group of devices should be enrolled with mutually exclusive enterprise binding.  A few years ago when AE was first launched, changing binding for a device in AEDO (i.e. managed-device) mode required the device to be factory reset, and thus assigned/reassigning devices with different bindings can be very painful and impractical.  However, more recent MobiControl versions and Google AE architecture have already supported changing  binding without device factory reset by using the "Reset Account" device action in MobiControl web-console.

Note also that Managed Play Store isn't the only mechanism for installing apps on Android devices. If you have access to the APKs, which it sounds like you might, then you can install those on devices either via Packages and Profiles or as Enterprise apps in an App Policy. Both options would allow you better control over what devices have visibility to and access to the app installs. 

Simply add all needed apps to the Managed Play Store.

Then create Application Policies for each device group, where you add only the apps, which the device group should see.