For such scenarion there is a native solution. No need to block anything,
Just use the canionical tag
<link rel=canonical href=https://www.mypage.com/>
and set your domain (Abs. URL) as value of the href, and not the preview.mypage.pages.dev one. So Google and other search engines know, that the original content is there and they should not display the “preview.mypage.pages.dev” links in the search.
Notice that all pages, which are containing such tag must, match the real URL. So if your subsite is /about-me then the canonical for this page should be:
Canonical URLs are a good idea, though Google does sometimes just see them as a ‘suggestion’, and will try and figure things out itself, which may result in the wrong page being indexed.
My recommendation would be one of the following, to prevent indexing of the pages.dev site entirely:
Add something like this to your _headers, to instruct search engines not to index when on the pages.dev domain:
I implemented the header solution you proposed as well as the canonical solution.
I did try Cloudflare access first, but it seems its incompatible with my restrictive CSP, and I don’t have the mental capacity to open that can of worms today!