I would like to use hardware security keys in an environment where it is additionally needed to lock down any ways in which a user could download data to a device like a usb key. Is it possible to lock down a usb slot in a way, that file transfer is not possible but hardware security keys still work?
In my case the scenario would include Windows 10 Pro as an OS and preferably a fido2 capable key.
One option would be to attach the security key permanently. This still keeps most of the benefits of the security key defending against phishing or credential stuffing.
Gluing the key into an external USB slot will allow using keys which require the user to press a button on the key, but will make the key impossible to replace if broken (or after a recall like the recent Yubikey FIPS key recall)
Attaching the key to a USB header on the motherboard (and locking the case shut) will allow replacing a broken key but means that you will have to use a key that works without a button press, which is slightly less secure due to not requiring user confirmation.