Google seems to be very good at finding new never seen before content. If you don't want it public then put some kind of authentication on it.
But Google also always respects robots.txt. If you don't want your content to appear just put a deny all for all domains. You can easily set that up in nginx by returning static content, you don't even need to create a file in the right directories.