My first question to you is what are these URLs? It's important to know what these urls role in your overall website (ie do they carry important search signals or not , or by them being crawled they actually diluting these search signals)

so based on your answer above :
if they are important , or duplicated then you need either 301 them and if too much dev time you go with your 2nd choice which is use rel=canonical. (PS canonical is a suggestion/hint to google and dnt active like directive )
if they are not important ( search pages, doorway pages or whatever) then you need to remove them either by a 404 or a 410 then after couple of months (when you see all of these urls has been disappeared from the index) apply robots.txt exclusion to not to crawl these urls anymore.

please note that the url removal works just for 90 days and if you didnt apply a robots.txt to disable bots from crawling them again then they will reappear.

hope this helps