The simplest solution to both of your problems is to place these .php files in a secured directory. Either placing them in the root directory or in a password protected directory will work fine; your pages will still be able to access them and include them, but crawlers will not be able to find them and users will not be able to view them.
If you do not have access to your root directory or have no way of password protecting a directory, another solution would be to simply verify that the page is included in another page through the use of a dummy variable. For instance, have each of these files check for the existance of this dummy variable, say $loadedFromFile, using the isset() function. If it does exist, do nothing, if it does NOT exist, redirect the user to your main page using the header() function. Finally, be sure to set $loadedFromFile in each of your calling scripts.
Hope that helps!