Corrupt the usbstor.sys driver and corrupt the system file recovery. (it will work, but you really shouldn't do that lol)
If these machines are being used by untrusted users as you indicate, since you must block USB storage devices, you should not allow them administrative access to the systems. You should use a combination of group policy and user account/group access restrictions.
You should also lock the bios with a password, and disable booting the laptop in any way other than the installed OS on the hard drive.