We address physical layer security in distributed antenna (DA) systems, where eavesdroppers (Eves) can intercept the information transmitted for the intended receiver (IR). To realize a user-centric, power-efficient and physical layer security-addressing system, we aim at minimizing total power consumption by jointly designing DA selection and secure precoding. Different from the conventional artificial noise (AN)-aided secure transmission, where AN is treated as an undesired element for the IR, we design AN such that it is constructive to the IR while keeping destructive to the Eves. Importantly, we investigate two practical scenarios, where the IR and Eves' channel state information (CSI) is imperfectly obtained or the Eves' CSI is completely unknown. To handle the CSI uncertainties, we solve the problems in probabilistic and deterministic robust optimization respectively, both satisfying the IR' signal-to-interference-and-ratio (SINR) requirement by use of constructive AN and addressing security against the Eves. Simulation results demonstrate our algorithms consume much less power compared to the centralized antenna (CA) systems with/without antenna selection, as well as the DA systems with conventional AN processing. Last but not least, by the proposed algorithms, the activation of DAs closely relates to users' locations and quality-of-service (QoS) requirements, featuring a user-centric and on-demand structure.