Prevent internal users from using production web-to-lead form to create test data in prod

Sure, you could lock it down on your server. Your server knows the IP address of the visitor, so you could prevent it at the server level directly. Or, with a minor tweak, you could write an IP address to a hidden field in the web-to-lead form, and make a validation rule in Salesforce. Other options are also possible, but any solution you want to use will require updating the server code, not necessarily Salesforce. Also, keep in mind that Web-to-Lead can be used by anyone if there's an exposed org ID in the source code, so if you're going to do this, I suggest including some sort of additional validation in the form of a "magic value" that can be validated by Salesforce but can't easily be predicted by a person. Again, this needs either server or client-side code outside of Salesforce.