And all the guys you want to deter to plug in a usb-stick are much more skilled with tools, metalwork, electrical connections than you are...

Better disable the usbstor service so that the USB ports are still working, only they don't make usb storage devices appear as disk drives :-).

(also some software might require a license-dongle to be plugged in)

You could also clip the connections at the motherboard but I am guessing most of them would be too lazy to bring in a new port to solder up.

So, often people will image a computer (e.g. to a 2nd harddisk or DVD) after changes had been made. So returning after one year you'll find that the hardware had failed for whatever reason and the image put back on another PC. So, restricting access in Software is more viable, in my oppinion.