Sorry, but I have to jump in - do NOT use all of those signals simultaneously. You'll make a mess, and they'll interfere with each other. You can try Robots.txt or NOINDEX on the page level - my experience suggests NOINDEX is much more effective.

Also, do not nofollow the links yet - you'll block the crawl, and then the page-level cues (like NOINDEX) won't work. You can nofollow later. This is a common mistake and it will keep your fixes from working.

Piggybacking on Kane - since these bad/phantom pages were in one folder, can you request removal in Search Console? It should at least speed things up. Unfortunately, the links can show for weeks or months after they're removed, even if Google doesn't seem to be caching them. If the pages aren't indexed/cached, and the numbers in the console seem to be gradually dropping, I'm not sure if there's a lot more you can do, unfortunately.

It's tricky. Practically, I tend to agree with Tom - if it ain't broke, don't fix it. Especially at small-to-medium scale (let's say hundreds of URLs, but not thousands), rel=canonical is probably going to do the job here.

Technically, CleverPhd is correct that paginated content may be better served by rel=prev/next, and Google isn't fond of you canonical'ing to page 1 of search results. Their other preferred method is to canonical to a "View All" page (and make that page/link available to visitors), if that page loads reasonably and isn't huge.

In practice, they don't seem to penalized anyone for a canonical to page 1, and I know some mega-site SEOs who use rel=prev/next and have been almost completely unable to tell if it works (based on how Google still indexes and ranks the content). I think the critical thing is to keep most of these pages out of the index and avoid the duplicates. If your approach is working for now, my gut says to leave it alone.