Hi, you can do this by pasting some code into your robots.txt file which is set in the SEO panel of Site Settings. Just paste the following:
into the Miscellaneous area of your site and then save changes:
This will to disable the search engine crawling of your site. Your sub-domain if published, is accessible to anyone who has the url.
What I usually do, is make a duplicate of the finished site, then give a cryptic sub-domain name, one that cannot easily be guessed and send that url to the client. There is still chance someone might guess upon the url, but if you make it cryptic enough you can reduce the chance of others looking at it... that is just quick things you can do..