Restricting A runner to a specific Environment

We have an existing deployment of gitlab (in house) and we are trying to get into using CICD as a replacement for Thoughtworks GOCD. We have a need due to regulation to restrict access to our Production Deployment Runners. We would like to use the protected environments and not allow those runners to be used in any stage not in that environment. This seems pretty standard and straight forward, but I have not found a way to do it. Does anyone have any suggestions?