This is an interesting question!
Should I link to them only via rel="nofollow"?
No because Google will still crawl the URLs even if you link to them with nofollow and they will get indexed.
Should I not link to them at all, and use Javascript to let users
access these pages?
This is a valid option, although depending on your implementation and Google getting better at crawling JS, it means they could still get indexed.
Should I use rel="canonical" on them?
Some may ay no, as the content isn't identical. However I've seen canonical tags implemented in similar ways, where only 50% of the content is duplicated from the page being canonicalised too, and they worked just fine.
So in this situation I would implement canonical, monitor it and see how it performs. If the canonicalised pages stay out of Google's index, I would say its a success. Also if some pages are indexed, but when viewing the Google cache of the page, if it shows the content from the canonical source page, not the canonicalised page, I'd also count that as a success.
If the canonical didnt work and all these pages are indexed, I'd block them from being indexed with robots noindex, follow tag.
The reason I'd try canonical first, is because any external SEO value the pages have I want to keep, so it will be passed along with canonical tags, where as using the noindex tag it will be mostly lost.
Should I block them via robots.txt?
I'd only block them via robots.txt, once I have gone the noindex tag route and have confirmed they have been removed from the SERPS.
If you add them in robots.txt before, search engines wont see the noindex tag as they cannot crawl the page, and the page can stay indexed if it's only blocked in robots.txt.
And the reason I might block them both in robots meta tag and in robots.txt, is to conserve crawl budget. I don't really want Google crawling pages I don't want indexed, when it can be better spent crawling my valid pages. So blocking in robos.txt will stop Google crawling them
