Every possible way to get data (posts) from WordPress

Since you aren’t able to use the out-of-the-box functionality (i.e. not publishing the posts!) you will inevitably have to cover yourself in a few different ways. You seem to have most of them covered – but a couple more ideas:

  1. The single post page itself. Assuming you are OK with the post never being visible at all from the public-facing website, you could write some code at the top of your header file that checks if the post is in the ‘unpublished’ category and if is is, simply exits.
  2. Archive pages As you noted – you’ll need to exclude these posts from archive pages (category, date and tag). You can do this by customising the query to exclude this category.

If you have a simple theme without multiple templates, this will be reasonably simple but not foolproof since you will still have designated these posts in WP as published!