The laptops go outside of our building daily. Port locks are an interesting option, but limiting the laptops’ connectivity options would likely bite me pretty quickly.
Having the laptops boot first to local disk is likely the option I will take with the laptops.
Thanks for the advice!