That would be a good way to do it. The other way would be to block it in the robots.txt file on the root directory. Although be careful you aren't blocking both since it's a subdomain.
You could also add a noindex, nofollow tag to each dev page but then you have to remember to remove those when you push them live to your real domain.
I'd probably go with the Robots.txt option since using the redirect will not allow you to view the site live which I'm assuming would take away from the whole point of having this "staging" sub-domain.