Idle #mastodev thought: another layer of post visibility: "Only visible to logged-in users". Identical to public visibility, except that it won't show up on your profile page or through a direct link unless the person is using the web interface or another client.
(I have no idea how you'd implement this, it's just an idea to give blocking a user more weight.)