If you cannot determine what language /xf/ should be because of multiple languages then you should remove the hreflang tag since you cannot define the language. This should remove the hreflang errors that you're seeing in Webmaster Console.
If you cannot remove the hreflang tags from the /xf/ page then you can disallow access to that directory in robots.txt as you suggest. Bots won't be able to crawl those pages and as a result Google will not index them.
You can also add
<META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW">
to your head tag. This will prevent Google from indexing the pages in the /xf/ directory as well as prevent Googlebot from crawling further links to /xf/ within that page which will help maximize the use you get out of Google crawling your site.
Using the NOINDEX NOFOLLOW tag will allow Google to crawl those pages when it discovers them from links. The potential benefit of adding this meta tag is that permitting Google access to the page helps Google know what your site is about and indicates to Google that you're not hiding any malicious content on your site that is blocked by bots. I can't guarantee that this will help your rankings, but it couldn't hurt.
The benefit of blocking bots in your robots.txt file is that since Google will only crawl your site a limited number of times a day, you know that some of those crawls won't be wasted on your /xf/ pages that you have notified to Google not to index.
Overall, I recommend that you consider trying to remove the hreflang tag from your /xf/ directory while allowing Google to index those pages. Unless of course you don't want them indexed altogether.