You've diagnosed it right, that's the hard part. robots.txt blocks crawl not index, and canonical is only a hint to Google not a directive, so parametered URLs still slip into the index. The fix you actually want is a targeted noindex on just those URLs, and since your CMS won't let you scope...