I imagine the only way to truly disable the USB ports is through appliance BIOS settings, which are not accessible to end users.
TAC may be able to assist here: https://help.checkpoint.com
The USB ports are how the appliance is reimaged in case the software image becomes corrupt.
In regular Gaia, the only time the USB drive is read is at boot unless an admin accesses Expert mode and manually mounts the USB drive.
On Embedded Gaia platforms, they can also be used to store logs for locally managed appliances.
I would reach out to your Check Point SE with your specific requirements in this area.