Would like to secure puck.js with a pin code but it fails

Hi! There are some options shown here that might help you: http://www.espruino.com/BLE+Security#passkey-pin-pairing

This should work fine to stop connections: NRF.setSecurity({passkey:"123456", mitm:1, display:1});

I was still able to correct to it via nRF client and change its name

I'm not quite sure what you mean here. I believe you may be able to connect to the Puck but you won't be able to actually do anything. 'Changing the name' may just be the name that appears in nRF Connect - so nothing on the actual device.

making it connectable only when the button is pressed.

This is probably safest. Also, if you're not advertising data all the time you can use less power and make it last longer. Again there are a few code examples on http://www.espruino.com/BLE+Security