If you disable USB ports in BIOS, they will be unavailable during the POST process as well. You need to leave the ports that is used for your keyboard and mouse enabled. Yes, this obviously does mean that a security "hole" will still exist.
As an alternative, if you enable Fast Boot in BIOS, the O/S will boot from your HDD/SSD completely ignoring all USB ports. With this setting, if you need to get into BIOS Setup, you can use the recovery menu (accessed by powering on the system by pressing and holding the power button for ~3 seconds). Windows 10 also offers a way to request that BIOS Setup be invoked on the next reboot.
Hope this helps,
This message was posted on behalf of Intel Corporation
Thank you very much to N. Scott Pearson for the information posted previously.
I just wanted to confirm the above information as correct, for a more secure configuration, the suggestions provided previously will be the best way to do that.
Any questions please let me know.