ericnixmd said:
I definitely try to keep everything as secure as possible, but I realize nothing is 100%.
If you don't need to use them disabling USB ports is a good idea. USB keys are terrible at spreading malware.

Blocking USB Devices and Removable Media - Active Directory GPO - Spiceworks

If you need them occasionally you can sign off your normal account and onto administrator account and enable them again temporarily.