1. Requiring a passcode to turn off the phone accomplishes nothing. There will always be a way to reboot the phone by pressing hardware buttons. This is necessary for crashes (where you won't be able to enter your passcode).
2. If you can reboot your phone, you can put it into DFU mode to prevent it from connecting to the Internet. This is done by rebooting, then holding the power and home buttons in a certain combination.
3. Disable Voice Dial from Settings>Touch ID & Passcode. Someone that steals your phone can call 611 (if on ATT) and go through a few automated prompts and disconnect cell service.
4. I disable Voice Dial and Control Center from the lock screen so people can't *easily* take the phone offline. They will either have to put it into DFU mode, or take out the SIM card and walk away from known Wi-Fi access areas. Most criminals of opportunity won't have the know-how or the tools (a paperclip) to take these steps. That usually will give you enough time to find a computer and remote-wipe or find the phone from iCloud.com.
5. Make sure you have the "Erase Data" setting enabled to lock out someone that is trying to brute force your password. Realistically, this takes about 2 days because after 5 attempts there is an increasingly long delay on how long you have to wait for the next attempt.
6. Enable Find My iPhone. If somebody steals your iPhone and it's locked with a good passcode and Touch ID, they will never be able to activate it for their own use. If the phone gets reset, it won't work until your Apple ID username/password is typed into it.