Is it possible to disable USB ports on iMac?

Question

I've got a pair of 27" iMacs which will be utilized as Flash Pro workstations by employees and subcontracted illustrators and animators. In the interests of security, specifically -- protecting my intellectual property (animated content), I'm interested in setting up these iMacs such that nobody can copy any files they're working on to an external hard drive, or upload the file as an attachment to a webmail account or to an external server.
It is my understanding that I can set up a standard account and via network preferences, disable the wireless, ethernet, and firewire functions, which could then only be reactivated by an admin account password. But it would appear there is no way to disable the USB ports. Is such a thing possible? Is there a way to disable the USB ports on an iMac or any Mac?
In the event there is no way to disable the USB ports, is there a way to prevent someone from copying files on this iMac to external hard drives or uploading files to webmail programs or servers offsite?
How do employers prevent employees and subcontractors from copying or sending intellectual property offsite?

Answer 1

Per Eric Ross's link above, it would appear that one can use Workgroup Manager from the Server Admin Tools, to manage user accounts even on a Standalone Computer -- not running on a network or utilizing the OSX Server Software -- as seen in the following statement from Eric's link:
MacInTouch Reader
"...   As an additition to Espen Koht's contribution, it should be mentioned that the 'Workgroup Manager' is part of the 'Server Admin Tools', which are distributed free of charge by Apple. Media access whether USB or Firewire for all users can be configured 'standalone' on each Mac computer by the user "Administrator"- it works!"
So I installed the Server Admin tools. According to the Workgroup Manager Help document, there appear to be two steps required to make the tools operational. First -- Setting Up an Administrator Computer and second -- Create a Directory Administrator Account. The Workgroup Manager Help document does not clearly explain how to configure a standalone computer for Workgroup Manager.
When I open the Workgroup Manager or Server Admin apps, I am presented with a window containing three fields that must be filled in. One is Address. The second is User Name. The third is Password. How do I determine the address? Do they mean IP address? What do I enter in the address field?
Regarding the Name and Password fields, do I enter the name and password of my admin account for this computer?... or use a completely different name and password?
Again the objective is to enable more comprehensive management and restrictions of Standard User accounts utilizing Workgroup Manager on a standalone computer.