Welcome to the Q&A Forum

If you know they are bad, I would recommend diavowing them. You never know when or if you'll get a warning. I would err on the side of caution and go ahead and disavow. There is nothing saying you have to, but it makes the most sense to me.

You can give the affiliates code with nofollow in there but if they remove it you have no control over that. However, 99.99% of the time they'll leave it in there. Affiliates don't want to help you outrank them anyway. As Wesley said above, have them use rel nofollow on the links and you should be fine.