I suspect that with
Facebook you meant the facebookexternalhit user-agent string that appears in your access logs? This is not a crawler and as such doesn't respect (or indeed needs to, but that's argumentative) restrictions in robots.txt. This answer from Jeff Sherlock pretty much explains their position on it. So having this in mind, you could simply create a new robots.txt rule to deny crawling to the directory in question for all robots.txt respecting crawlers:
Where you replace
[directory] with the name of the directory you don't want Google and other crawlers to crawl and index. Alternatively, if you have access to your web server's configuration, you could serve different
X-Robots-Tag header values to different user-agents that your web server detects. If you're on Apache, your configuration could look something along the lines of:
Header set X-Robots-Tag "noindex, nofollow, noarchive"
Or even add these
robot directives in your HTML (if served from your
<meta name="robots" content="noindex, nofollow, noarchive" />
As far as I'm aware, none of these directives will be respected by Facebook, so this should match your requirements. Rationale behind Facebook's decision not to respect these headers and robots.txt is that they're shared, liked,... by their users, so
robots does not apply. Needless to say, we don't really have similar humans.txt restrictions we could use in cases like this.
If blocking facebookexternalhit user-agent is desireable, then you'd have to either block it in your web server's configuration, or detect such user-agent string in your web application that serves the contents of your webpages.