@jgreely’s way is the correct one.
I just wanted to mention that it is now possible to publish pages that do not show up in lists, sitemaps …
If your information is not super-private you could consider publishing it as something like https://domain.com/internal/aFidGwd90125FcigW.
Add this to your page’s front matter:
_build:
list: false