Anybody without an eye code who can pass the Voigt-Kampff test is human (but unfortunately we don't see this in either film)
There are two ways to detect a replicant that we see in the films: the Voigt-Kampff test and the Nexus-9 eye code.
Humans will pass the Voigt-Kampff test, but the audience is never shown anybody who does
In Blade Runner, Nexus-6 replicants and older are identified via the Voigt-Kampff test, which is a series of questions that are designed to provoke an emotional response. When Tyrell is discussing it with Deckard, he expects that it can result in a negative (i.e. not a replicant) if done on a human.
Tyrell: I want to see it work on a person [i.e. human]. I want to see a negative before I provide you with a positive.
Deckard: What's that going to prove?
Tyrell: Indulge me.
Later, once Rachael is revealed to be a replicant, she asks Deckard if he ever took the test to prove that he was human.
Rachael: You know that Voight-Kampf test of yours? Did you ever take that test yourself?
So it's clear that this test is expected to be reliable enough that anybody who passes it will be identified as a human. Unfortunately for the audience, nobody is shown to do this.
Nexus-9s have an eye code, and there is no evidence that there are "unmarked" Nexus-9s
2036: Nexus Dawn, one of the promotional short films for Blade Runner 2049, shows that Nexus-9 replicants do have an eye code.
We don't see an eye code for every Nexus-9, but those we do see like K are in positions where their eye codes would certainly have been checked at some point (e.g. during the psych screening).
While it's certainly possible that Wallace created an off-books Nexus-9 replicant that lacked an eye code, there is no evidence to suggest that this ever happened, nor that anybody had any motivation to do so. Indeed, Wallace's attitude, especially in 2036: Nexus Dawn, suggests that he wants others to be aware of his replicants and what they do in order to demonstrate how they are fully under his control.
Thus without further evidence to the contrary, it would appear that anybody who lacks an eyecode is not a Nexus-9 replicant.
In the source material, Deckard and a few others are proven to be human
While not a part of the movie universe, the novel the film is based on, Do Androids Dream of Electric Sheep?, makes it very clear from the Voigt-Kampff test that Deckard is a human.
Rick [Deckard] said, "I'm not an android. You can administer the Voigt-Kampff test to me; I've taken it before and I don't mind taking it again. But I know what the results will be. […]"
When he takes it again later "on-screen" to test if he has an emotional response towards androids (i.e. replicants), Deckard provides a suitably empathic response that only a human could produce.
Rick said, "A female android."
"Now they're up to 4.0 and 6. respectively."
"That's high enough," Rick said; he removed the wired adhesive disk from his cheek and
shut off the beam of light. "That's an emphatically empathic response," he said. "About what a human subject shows for most questions. Except for the extreme ones, such as those dealing with human pelts used decoratively . . . the truly pathological ones."
This is corroborated by the similar Boneli Reflex-Arc Test being run on him earlier, which also identifies him as a human.
While there is discussion about how new androids will eventually be able to pass these tests, and that there may be a small subset of humans who might fail it (such as due to mental instability), everyone views the Voigt-Kampff test as a very reliable way to detect androids.