Miners don't calculate nonces, they calculate cryptographic hashes using nonces as one of the inputs.
A cryptographic hash is a function that takes as input some arbitrary data and produces as output a unique string. They always produce the same output string for the same input data. Here's an example using the sha256 hash function (the basis for the function used in Bitcoin):
$ echo foo | sha256sum
$ echo foo | sha256sum
$ echo bar | sha256sum
In the above, "foo" and "bar" are the input and the strings starting with b5bb and 7d86 are the output.
What miners attempt to do is find a hash output that has a certain number of zeros in a certain location (we usually call this the start or front of the hash). To do this they start with the data they want to add to the ledger and then increment a nonce (or otherwise adjust the block) until they get the desired value.
For example, let's say we want to add a transaction of "Alice pays Bob 10 BTC" to the ledger and the number of zeros we want at the start of the hash is just 1. We start by doing this:
$ echo "Alice pays Bob 10 BTC | nonce: 0" | sha256sum
As you can see, our first nonce of "0" didn't produce a hash starting with 0. So we try again:
$ echo "Alice pays Bob 10 BTC | nonce: 1" | sha256sum
Again, we don't get the desired result. So we keep trying over and over until we do get the desired result:
$ echo "Alice pays Bob 10 BTC | nonce: 18" | sha256sum
So we had to do the work of generating a hash 19 times before finding a hash starting with the number zero. This is called proof of work.
Now the person who found this proof of work can share all of the data---both the transaction and the nonce---to other people, and those people can verify that the input data of "Alice pays Bob 10 BTC | nonce: 18" does equal the a hash with one zero worth of proof of work.
One zero worth of proof of work isn't much (it's 4 bits or odds of 1:15), but real miners deal with much greater amounts and producing all of the work requires consuming a large amount of electricity. Normally miners are rewarded for consuming that electricity by receiving a reward for protecting transactions with proof of work---but they only receive the reward if the transactions they protect are valid. Otherwise any proof of work they generate is wasted, meaning the electricity they use is wasted and they'll be less profitable than other miners who protect valid transactions.
For example, in the above example, if Alice didn't have 10 BTC to give to Bob, then that transaction would be invalid and so it wouldn't matter that the hash of the data starts with a zero---users who verify every transaction using what's called a "full node" will simply ignore that transaction and its proof of work.
So in short, what prevents a miner from adding an invalid transaction to the ledger is a combination of users who reject invalid transactions with their full nodes and an economic incentive paid to miners who mine valid transactions.
 Hash functions don't always work like this, but that's the ideal.
 But that's because Bitcoin displays hashes weirdly. To any other tool, it'd be the end or back of the hash.
 Technically, they only receive the reward if other people think their transactions are valid. Currently, there are a lot of Bitcoin users who verify every transaction, so it's not possible to sneak in an invalid transaction. In other cryptocurrencies or a sad future where Bitcoin becomes less secure, that may not be the case