How I can ensure that no bots visit the links that I generate and send via email?

In my application I generate links in the following form:

https://example.com/^token^

Where token is a 5 byte cryptographically-secure random token.

As I ask via:

https://webmasters.stackexchange.com/questions/132427/how-i-can-ensure-that-a-link-sent-via-email-is-oppend-only-via-a-mail-client

I need to prevent bot visits towards these links. So I want to ask:

Is robots.txt and nofollow,noindex meta enough to prevent the bots from crawling the content?
Does the token length makes bot's life hard to brute-force links?
Is there a way to ensute that a link is oppened via mail client either web or traditional (SMTP/POP3/IMAP based one)?