Idk if libreboot is coreboot+ a specific payload. But in edk2 which is used in dasharo you can set some UEFI boot targets and disable usb boot yes, of course also set a firmware password. There is also HEADS which is another payload of coreboot and can use a hardware security key to need to approve boot drives. Makes most sense with very stable distros like Qubes though as you dont constantly re-sign everything