It really depends on who you are trying to secure the machine against.
If you just want to deter honest but creative users from plugging random USB devices in ports, some tape over the ports ought to be sufficient -- to remind them that this is not acceptable behaviour. Prefer some tamper-evident tape: this will make it more "official looking".
If you want to prevent evil attackers from plugging USB devices into the machine, conditions are harder. Such a person could also bring a screwdriver and open the laptop case altogether -- this is not that hard, and can be done relatively silently and quickly. Storing the machine in a hardened case would be safer. you would need some air flow to dissipate heat, but this can be as simple as a metal grid in front of the air holes of the laptop. The keyboard would still be a challenge: if the attacker can put his hands on the keyboard then he may "dive" through it (destructively, but attackers are not nice people).
Alternatively, you may plug an external keyboard, letting the wire exit the box, but this gives an entry point to the attacker: by dismantling the external keyboard, the attacker would gain access to some wires directly plugged into one of the laptop USB ports, the very thing you would like to avoid. Paradoxically, a wireless keyboard might be safer here, or not, depending on the details of the radio protocol between the keyboard and the dongle plugged in the laptop (and it would be in flagrant contradiction with the whole "air gap" concept).
To sum up, if the potential attacker is definitely hostile and has physical access to the machine, then you are in big trouble, and you need some really strong protection (supervision by an armed guard or even with CCTV could do the trick). If, on the other hand, the attacker is not really evil, then this becomes a matter of user education, and simple "plugs" should suffice.
