These two criteria are often at odds with each other. If the voltage is high enough to be dangerous, and the instrument will sometimes need working on, the time-constant is best to be no more than a few seconds. Since that usually means excessive dissipation, my approach is to pick the appropriately-timed resistor, with its wattage sized to handle the discharge energy from the capacitors, and switch it with relay contacts. When unpowered the relay contacts should be closed. When AC power is applied the contacts will open an instant later, and the ac transformer/ diode-bridge/resistor simply handle the high current flow for twenty or so ms. If the relay fails to open, the fuse should blow after a second or two (make sure the resistor is small enough for this to happen).