Definitely use the noindex, nofollow tag plus password protect the folder that the download page resides. There are also software such as DLGuard which help with protecting your download page. I suggest using a combination of both.