I would suggest doing both considering it tackle two different issues. The Visibility being set to selected levels will ensure the page content cannot be viewed. The robots.txt file will ensure the links to the content and pages through the site cannot be indexed and also helpful in blocking the bots from indexing directories that contain scripts.