Depends on the size of the build and the budget for dev resources. But on a larger site we have 3 sites. And a lot of these are a topic in their own right. The most solid setup is to have three sites.
This can be local or shared. If shared typical sftp access. Changes are tracked in git. Try to use something like git flow to enable multiple devs work on the site at the same time. If working local something like docker.
Client has acess to the site. But locked down to outside world. This site is often used to get work signed off before going live. My team has mixed feelings about staging site but I prefer to have deployment configured. There's lots of different ways in which this can be done but basically pushing to master in git on a particular remote will trigger a deployment process which triggers magento processes to upgrade and deploy static content. It's useful for staging site to have near live data but to help debugging but not necessary.
Deployment configured. Production master remote triggers deployment. Caches on. Open to public. Only approved changes are put live. Larger updates are put live outside of busy periods.
Sorry all a bit vague. But this is a huge topic.
But yes changes in git and no not on a live site. But nobody is perfect and we've all had to do a bit of debugging on live site because of unexpected condition. Magento is complex and at times unpredictable.