How to de-index the staging site but not the website in production?

Hi, we have a website in production (xxx.com) and a staging website to test things out (website.xxx.com). The staging site has been indexed by mistake. What is the best way to de-index the entire staging website (not page by page, but the whole staging website in one go?) We already use a password for the staging website that we need to remove once in a while. Would using the header tag be the best solution? What kind of code should we use to deindex the whole staging website at once? Thanks!