Well USB certainly shouldn't a problem, as normal users don't even have permission to mount removable devices normally. Unless you are using HAL to do automounting, in which case you can just stop that service.
As for Internet access, would it be enough to remove all DNS servers from the system's configuration, and then address the server you wish them to view by IP? Granted this would still allow Internet access if the IP of the outside server was known.
Alternately, you could just filter access through iptables.
|