To deploy something, a transaction needs to be signed by a private key. The signing can be done by someone else than the developer, but it gets a bit complicated in my opinion.
As I see it, you have at least a few different options:
1) The developer only develops code and you do all the rest (deployment and so on). When code is ready, he gives that to you.
2) Developer deploys the ready product into a testnet where you can test it. Otherwise same as the first option.
3) Developer handles all deployments (also to mainnet) in which case he needs some private key (unless he sends you the bytecode, you sign a transaction of it and he continues with that, but that's a bit complicated approach). If wanted, developer can then assign whatever ownership status to accounts which your control.
I guess all of the options are used in real life and I can't tell you which ones are the most common / best.
In general, I would not give the developer the final ownership of the contracts in mainnet so he would only get paid after ownership has been transferred to you.