Welcome to the Q&A Forum

Generally I'd not worry too much about duplicate warnings like this, especially if the duplicate pages are being created by parameters. Though Moz won't be able to see it, check Google's search console (AKA webmaster tools) under parameters to see how many portfolio IDs are being crawled. You can even set the parameter manually, though I find "Let Googlebot decide" usually works just fine. The canonical tag is a good idea. Definitely use a canonical tag that to point back to the original version of the page. Without seeing the site I can't give you more specific info than that. I'd probably not use robots.txt, just because I'd worry your content would be harder to crawl once a session is tagged with profile ID. It all depends on where users/bots pick up the profile ID variable from.