How do I create a secure clamping circuit?
This is a frequent issue: for example opamps driving and ADC and pumping the 3.3V line up so something else. Today's opamps are strong.
A zener diode saves the day, as for question one. It simply dissipates the voltage excess. You have to do some balancing for tolerances but it works fine.
Case number two is trickier. Usually you simply try to minimize the voltage and current in the ESD diodes. For example, most of the time you have an absolute of -0.3V to VCC+0.3V in ratings. That works well with schottky diodes. Also if you keep the fault current to less than 1mA they can usually sustain it without issues. There is some useful information in the old microchip TB3013 application note