since I know of no way to disallow booting from removable media. newer bios’es give you the option of locking usb boot from behind a supervisor password. – meaning that you have to give the supervisor bios password if you want to boot from usb.