Surge protection for differential amplifier
For reference, here is information for real-world protection units, meeting sets of safety regulation specification, as used in industrial plant settings, says, sensors and remote control wiring running hundreds meters on outdoor paths, subject to lightning strike. 



As original poster suspects, cascaded protection is typically used inside these unit.

You may design your own unit, based on below general information, or buy off-the-shelf.

Gas discharge tube, with different rating specification, is used as the front, to take majority of the energy of the incoming lightning induced surge pulse. This example unit is rated 10kA for 8/20 surge timing profile.

The next is inductor to attenuate fast rising pulse. The current rating is 250mA in this example and can be used for sensor and power supply protection. Some units have lower current rating and limited to sensor use (like 20mA loop sensor/transmitter or near zero current like thermal couple). 

Very fast semi conductor devices are used at the final stage to clamp the residual surge to the rated 6V, as in this example. Different unit has different voltage rating, choice depends on the expected operating voltage of the signal line (for thermal couple, near zero. a bit higher for power supply or 20mA transmitter)

For info at a randomly chosen example meeting safety regulation specifications   

For info on test specification on pulse shape, like 8/20us, pulse shape info