Hi Phil,
The upgrade process is correct and the one I recommend.
There are a few ways to prevent indexing:
1 - If you have access to the site's server or IIS you can actually block all other ips from coming to the site except your and someone else's you may want to share with. You can find info on how to do it at:
https://docs.microsoft.com/en-us/iis/...
2 - If that is not the case, then you can use the robots.txt file to instruct Google to NOT index the site. For that just put this on the file:
User-agent: *
Disallow: /
But remember to remove it and restore to what it was before once you go live, otherwise Google will stop index the live site!
Cheers,
Aderson