You can probably write a specific location block for robots.txt which will have a higher priority.
See also https://stackoverflow.com/questions/5238377/nginx-location-p...
See also https://stackoverflow.com/questions/5238377/nginx-location-p...
Only if they ignore robots.txt the access rules will stop them.