Protecting a 3.3V board against a 5V programmer
You appear to be trying to solve a problem that should not exist if you use a properly designed programmer.
Pin 2 on the programming header is not a VCC input - the programmer should not be providing power to this pin.
Instead it is a VTGT output - the target (your device) provides power to the programmer via this pin, with the programmer then using this voltage to configure its I/O voltage levels to match the target.

Regarding option 1, either yes always use your modified programmer, or use a properly designed programmer which uses the VTGT pin as specified by Atmel/Microchip.
Regarding option 2, not connecting this pin to the supply of your board will prevent properly designed programmers from functioning as there is no target voltage provided for them to use, and no power will be supplied to your microcontroller.
Furthermore powering just the MCU from the VTGT pin using a poorly designed programmer that powers that pin, will result in the MCU running at a different voltage from the surrouding circuitry (e.g. your pull-up resistors) which is never a good idea.
Regarding option 3, it is not the responsibility of the device/target to provide level shifting. If you want to add level shifters, add them to your programmer circuit and use the VTGT pin in the way it was intended.