how to block internal Drupal paths for anonymous users?
If you have clean URLs enabled, and are using the Global Redirect module, the users should never actually see the default paths (sometimes also called the internal path).

If a user goes to node/123 or taxonomy/term/456, and a path alias exist, then they will get an HTTP 301 and then redirect the the path alias.  Google and won't index the paths that 301.

In addition, Drupal will add a rel='canonical' to the header, to notify the world about the offical URL.

However, if you ever had you site without Global Redirect enabled, then you could at one point access pages from multiple paths.  Once Google starts seeing 301 responses for paths, it will eventually delist the page.  You can speed up the process by also disallowing the paths in your robots.txt and/or submitting page/directory removal requests.  Just remember to backup your robot.txt (or better yet put it in your VCS) because it will get nuked during core updates.