how can I test my website online with next.js so no one but me can see it

I'm currently coding a website with Next.js and I like to put it online so that the rest of my team can test it (they're not dev) but I don't want anybody else to be able to access the website.
I saw that vercel kind of do that by creating 2 urls.
One for the testing and the other for deployment.
But I only want the url test, not the deployment.
Is it possible to disable the url ? (I didn't find anything on Vercel documentation)
Or is it possible to add something in my code so that the bots don't index it ?
I saw in an other post that I can use a meta tag on the head tag to prevent bot to index the website but with Next.js I have a head tag for each page so I'm not sure in which head tag to put this meta tag.
Another person proposed to create a robots.txt file to disallow user-agent.
Could that work ? And could that work with Next.js ?
If so, where do I put the robots.txt file ?
In my root project or in my public folder ?
Thanks for your help !