Deva

A deva on the party's side is the messenger angel of a deity, and it is borrowed, not given. It arrives with a stated purpose, completes that purpose, and leaves. Anyone trying to keep it longer is asking a god for something the god hasn't offered. Set the scope of the visit in your first sentence of narration: "The deva is here to bless the temple. It will do that and return." If the players push past the scope, the deva listens politely and refuses.

In combat, lead with Divine Aid as a Bonus Action when someone needs it. Cure Wounds, Lesser Restoration, and Remove Curse cover most party emergencies, and you have it twice per day. Then use Holy Mace twice per turn at +8, average 25 damage per hit (7 bludgeoning plus 18 radiant). The radiant rider is the whole point: undead and fiends drop fast, and your party's neutral-aligned barbarian is just as safe standing next to the deva as they are anywhere else. Detect Evil and Good is at-will, so the deva already knows who in the room qualifies for either. Use that knowledge to mark a single target as the priority, and don't apologize for it.

Spellcasting choices matter most outside the swordfight. Commune (1/day) is the deva's main contribution to the campaign: a yes/no question to the deity, three answers, no save. Tell the players the question budget before they ask, since wasting one slot on "is the duke evil" feels bad in retrospect. Raise Dead (1/day) is a one-time miracle the party should know exists but should not expect. Save it for a death the table will remember.

Magic Resistance plus a 19 Passive Perception means surprise rounds and disabling spells mostly bounce off. The deva is hard to disrupt, which is right: it's a finite resource, and finite resources should not get burned by the first counterspell that comes along. Once the work is done, the deva says one brief blessing and lifts off on its 90 ft. of hover. Don't drag the goodbye.

Write the deva's farewell line before the session. A clean exit beats five minutes of awkward improvised goodbye, and the line should be the kind of thing one PC will remember on their deathbed.

A hostile deva is a tragedy you have to set up. Devas are messengers, not warriors, and one drawing steel against the party means something has gone badly wrong: a corruption in the divine chain of command, a lie about the party's deeds, a relic the deva has been sent to recover and the party doesn't know they have. Sell the misunderstanding for at least one scene of dialogue before swords come out, because a deva that's wrong about the party is a story, and a deva that's right is a sentence.

Once the fight starts, the deva is patient and methodical. It opens at altitude (90 ft. of hover) and uses Detect Evil and Good to identify any actual fiend, undead, or charmed creature in the party. That target gets prioritized. Holy Mace twice per turn at +8 averages 50 damage on full hits, and the radiant component punches through most party resistances. Magic Resistance gives Advantage on saves against the cleric's Hold Person and the wizard's Banishment, so the party's fastest path to victory is also their least reliable. Divine Aid heals the deva on its own turn (Cure Wounds on itself), which is a release valve when the party connects.

Commune is your release valve too. If the fight is going badly, the deva pauses, asks the deity a yes/no question about whether to continue, and may simply withdraw on a "no". That gives the party an out that doesn't require killing an angel they've now realized they shouldn't be fighting. Devas don't do last stands, and the campaign is better when they don't die at all.

The fight should end with a misunderstanding cleared, not a corpse. Telegraph the deva's reasoning to the party every round, even mid-combat. The horror of being killed by something that thinks it's right is more interesting than the damage roll.