If you're working as a contractor for the U.S. Government, as is generally implied by your requirement for USGCB compliance, then they will probably require that your system be put into a Security Plan which is compliant with NIST SP 800-53 guidelines. The process for this is not without exception. For any control in 800-53 that you cannot meet, for any reason, you may propose that your client simply accept the risk of not meeting the control.
Ultimately, it will be up to the government whether the proposal for accepted risk is approved but you should not have much problem so long as your justification is strong and sound. If they do not approve the AR, they may add remediation of the problem to the Security Plan's Plans of Action and Milestones (POA&Ms).
All that said, I do not expect you will get a full waiver on Flaw Remediation (SI-02) or Malicious Code Protection (SI-03) simply because the computer is non-networked. Security updates can be taken to the system via sneaker-net (e.g.: Offline WSUS) and most antivirus vendors also provide manual downloads of their signatures and program updates for offline install.
For multi-factor authentication however, you will probably need to propose an AR. Unless the system is connected to some sort of authentication server that can manage and validate the PIV credentials, I don't think there's any way that Smart Cards (or any similar two-factor authentication method) can be of any real use. For this, you'll have to propose an AR against some of the enhancements to Identification and Authentication (Organizational Users) (IA-02). Which ones will depend on the FIPS-199 categorization of the data type(s) handled by your system.
Medium: 1, 2, 3, 8
High: 1, 2, 3, 4, 8, 9
Enhancements 1, 2, 8, and 9 only apply to network access so your system will be exempt from those anyway. While enhancements 8 and 9 don't specifically call out multi-factor authentication, most "replay-resistant mechanisms" do involve multi-factor authentication. Check with your customer to see what the Organizational Defined Values (ODVs) are for "List of replay-resistant authentication mechanisms used for network access to accounts".