The BIOS/firmware would have to be locked down and disallow USB/etc. booting, I don't think that's normally covered by MDM? Does UEFI even expose an ability to control that via software?