For those devices whose USB ports support storage devices, they cannot be disabled via software configuration.
Most new switches have mini-USB as an alternative console. That and the traditional console can likewise not be disabled, although you can secure the console port(s).
Generally speaking, risks due to physical access are managed via securing the area - not the physical switch chassis and ports themselves. I have seen the more secure environments use "FIPS kits" (tamper resistant labeling) that cover key access points such that if they are removed it is quite evident the integrity has been breached.
