>but that doesn't really work when you're given a Macbook and able to work from home and coffee shop etc.
MDM like jamf and/or EDR/Antivirus like SentinelOne and Carbon Black can disable USB ports/anything in software. If your account is not admin/root you cannot remove them also.