I don't use robots.txt because they say that doesn't stop them from including the site in search results: https://support.google.com/webmasters/answer/6062608 I don't know if returning a HTTP 403 error will, but it seems like it's worth a try.
I also looked into banning IP ranges (that would have been my preferred option), but if I remember correctly they were subject to change and it seems overkill to write a scraper for that page that would then have to generate a config file and reload a service.