The header has two values that browsers support. DENY means the page can never be shown in a frame. SAMEORIGIN means only pages from your own origin may frame it. A third value, ALLOW-FROM, was meant to name one permitted site, but it is obsolete and modern browsers ignore it.
The newer way to express the same rule is the frame-ancestors directive of Content-Security-Policy, which also lets you list several permitted sites. Browsers that support frame-ancestors use it in preference to X-Frame-Options. Sending both is common: the CSP directive for current browsers and X-Frame-Options as a fallback.
The header must be sent as a real HTTP response header. Putting it in a meta tag inside your HTML has no effect. If your app is meant to be embedded, for example as a widget on customer sites, use frame-ancestors with an explicit list instead of leaving framing open to everyone.
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'