Short answer, they can't keep them out, but they can defend against them. That involves actual manpower and stout locks on upper doors or windows. Bars.
Even though today we do not build underground for fear of aerial bombardment, we do have anti-aircraft and other defenses. However, if this is part of their history, consider that buildings will be designed differently AND do not discount the idea of grand underground palaces.
Consider the Basilica Cistern of Turkey (see pictures in this link). The outside is just a single tower with one entrance at the base, but the inside is the size of a cathedral, and fairly lavish in architectural details.
But excluding living underground, as you say, what are the defenses?
Watchtower guard alerts These guards are set indoors and their only job is to watch for attacks on the top of the towers outdoors and on the walls. Set several men with a vantage point and a bell pull to alert the rest of the castle of possible aerial attack. Instead of windows, they get murder holes to better prevent being attacked themselves.
Limiting Movement in all Directions and then killing them... In most Medieval Castles, you have a gate, and contingencies once the opposing force gets through. In other words, you have a small space between the open gate and the next gate. While they are trying to get through, you pour oil in. Take this idea and apply it to creatures that can fly. Perhaps once the gate the first is shattered, another gate comes down trapping people between the two, then you empty the cistern into it and it rapidly fills with water up to the ceiling long enough to drown some. Or you have a ceiling that comes down with spikes. The mechanism of course would be inside away from your attackers. You can basically apply this motto of limiting movement as much as possible to any and all designs.
Good archers Everywhere.
Whatever the case, you will need to shore up specific points of entry that would be easy to circumvent. Take a design of a medieval palace then "attack" with your flying troops and whatever capabilities they have. You'll be able to see the weak points, and then counter those by re-designing or eliminating features that make it weak. Things such as limited rooftop access, making the way in narrow if you do get in, having defenses ready to drop down if there is an incursion over the castle and into the courtyard. The open balcony designs are right out...