Get your current
config.gz and deploy it in a source tree as described in this answer.
make menuconfig and go into the "Device Drivers" submenu. Make sure "Serial ATA and Parallel ATA drivers (libata)" is disabled. Scroll down to the "USB support" sub-submenu and make sure "USB Mass Storage" is disabled. You could completely disable USB too if you want.
If there's nothing else, you're done with the configuration and can build the kernel.
As per my comment on the question, though, if this is an environment where you are seriously concerned someone might open the box to reset the BIOS, such a person will also find a way around this -- you cannot secure the hardware with the OS. If you really need to do this, disconnect and remove the USB jacks. WRT to the SATA ports, you probably can't do much unless you want to desolder them or something. You'll need to lock the case. A setting where someone can access the motherboard and fool around with impunity is simply not secure otherwise.
Even then, if the machine boots from a network, I imagine I could bring in a laptop and swap some cables around...depends on what you are trying to accomplish, I guess.