Same as the others this is my opinion:
- Is installing zsh on production server harmless to the system?
Define 'harmless'. Strictly speaking, it causes no direct harm. However, any code that is on your production system is a potential attack vector. In that sense, it's not truly 'harmless', in that it could be used for an attack on the system. There are also some other ways it indirectly could cause problems. ZSH is a bit more resource hungry than bash for example, which could matter on a system running near capacity.
- Would you allow to install zsh in this case, and why so?
Depending on the exact circumstances, I might already have it installed.
All of my personal systems have ZSH installed and set as the default shell for everyone including root. This is simply because I'm pretty regularly working from a local shell on these systems, and I actively use ZSH in many cases.
However, all of the systems I administer at work do not have it installed. About 95% of the administrative work I do for them does not involve me ever actually touching a shell on these systems (I do a lot through Ansible at work), so there's no point in me making it a familiar environment. I'd also be very unlikely to install it on anything but our actual development systems, and there's no chance in hell I'd install it on anything that's directly accessible off-site.
- Does it make sense to restrict users with bash on production server?
I'd question the practicality of letting regular users touch production systems at all beyond certain very restrictive cases that do not involve actual shell access.
For example, where I work, only the IT department and the people directly responsible for maintaining our website have anything but regular HTTPS access to our web servers. The IT people (myself included) must log in with a special account only used for administration of the web servers, and even then they have limited access to the systems unless they're sitting at the physical console in the server room. The web designers only have SFTP access to the root of the website, and nothing else. Given this, there is no need for any shell except bash (which is our standard internally for administrative usage).
Similarly, for our internal file servers, only the IT department has actual shell access. Other users have specially limited access to certain directories, usually allowing regular file server protocols (SMB, NFS, etc), plus SFTP, and in some cases rsync, but none of them have any real shell access, because they don't actually need it.