Thank you for an excellent question. This is an area where we want to strengthen both the tools in DHIS and the set of recommendations that we have for users implementing.
To give the short version here, we recommend running at least two instances - one live and one used for development. When going live, the two instances should have the same metadata configuration - for example by restoring a copy of the live database as the development server database. After that point, any metadata changes would first be done in the development instance. When they are ready to be deployed to the live instance, the metadata is exported from the development instance, and imported in the live instance.
Wether the above approach would be applicable to your use case would depend on your use case - if you use tracker/capture programs, how many users and how well you can communicate with them, what your uptime requirements are and what types of changes you want to keep making to your system after going live. We can talk in more detail about your case if you want.