Hiding a WordPress Page from Search and Google

I've come across an interesting situation with a friend's blog and I'm hoping to get some clarity here on the best way to fix it.

He sells some ebooks on his blog and has multiple download pages that he wants to keep hidden. The theme that he uses allows us to NoIndex the pages, so we're comfortable that they're hidden from Google. But we've since discovered that if you type in the product details in the search widget in his sidebar, the pages aren't hidden from the WordPress search and show up in the search results.

We've since found a plugin called Simply Exclude that enables us to manually exclude those pages from the WP search results.

Is there a better / easier way to exclude pages from the WP search results.

The blog uses the Google XML Sitemaps plugin. We've discovered that even though we've marked the pages NoIndex, they still show up in the sitemap. When I view the page source I can see the NoIndex clearly up the top so I'm assuming that when the Google bots crawl the site via the sitemap they'll stop crawling those pages when they see the NoIndex.

But the problem is that the sitemap is still visible to humans. It's simple to type in the URL/sitemap.xml and view all the pages. All the pages that we thought we'd hidden are visible here.

What is the best way to fix this so no-one is able to view the sitemap? The plugin gives us the option of manually adding pages to exclude. I've also seen suggestions that you re-name the site map. But if we do that, are we making it harder for other search engines to crawl the site?

Are there any other things we need to consider to get these pages hidden from the world so only people who purchase the products can download them?