You can disable USB ports from BIOS in almost all motherboards. Get the motherboard manual to see how you can achieve this.
Other option: go to the Device manager (Start > Run > devmgmt.msc) and disable USB ports there.
If user has admin rights he will be able to get them running back.
Or you can follow this
http://www.petri.co.il/disable_usb_disks.htmor this
http://www.petri.co.il/disable_usb_disks_with_gpo.htmHope that helps,
Pancho