You can read more about whitelisting here.
You can try to test with the ble_app_proximity example if you SDK v10 or earlier we demonstrated whitelist in that example. Or have a look at ble_app_keyboard ifyou use SDK v11 and later.
Yes, it's the most common solution (note: there is nothing called public key unless you are talking about LESecure connection).
Another solution is to let the application disconnect the connection if the central device can't provide correct "password". For example, the central must write to a characteristic a "code" in the first 30 seconds after connected or it will be disconnected. But this is not very common only used when whitelisting can't be used.
Yes, it's the most common solution (note: there is nothing called public key unless you are talking about LESecure connection).
Another solution is to let the application disconnect the connection if the central device can't provide correct "password". For example, the central must write to a characteristic a "code" in the first 30 seconds after connected or it will be disconnected. But this is not very common only used when whitelisting can't be used.