Ideally, it would be nice if there was a way to disable it in software either from Digital Factory or from the settings menu on the device's screen that is already locked via PIN.
I wasn't aware of USB port blockers with keys so I'll have to give that a look.
I'd also thought about physically disconnecting the USB port from the mainboard but that seemed a little extreme. If we ever needed to use the USB port, for whatever reason, it would become a hassle.