There is no built-in option for this, but you could probably create
a deployment package to enforce this. A Google search will lead you to hundreds of articles on these topics. To lock down USB ports for instance, modifying the Start value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor appears to be an option,
as outlined in Microsoft's knowledge base. This is something you could implement with a deployment package.