I think everything you want to do can be done with little trouble.
WordPress configuration options ought to let you lock down the blog very tightly. You’ll need to set up your own robots.txt file to ban all “well-behaved” search engines from indexing the blog. That won’t guarantee complete privacy, though. Badly-behaved bots are free to ignore robots.txt, and they do. Google for “robots.txt generator” to get some ideas how they work and what
Additionally, I suggest you not publicize links to that blog _anywhere_. Web spiders (badly behaved ones) could find the link and try to visit the site. There are plugins that help block access by such bots if they do visit.