If a user or a visitor sees a port, they will try to stick something into it and then complain to us when it doesn't work or breaks their stuff. Are there such things as physical locks that can be put into ports so they can't use them?
Disabling a port is only half the solution/battle in our case.
You could just fill the ports with epoxy glue.
Some companies do this to ensure that employees won't steal data or bring viruses/worms/etc into the network.
RJLockdown is the only product I've been able to find that seems to be able to do so. Its a bit ugly, but it should do the job. Most solutions entail MAC filtering and software solutions, which obviously is no good for your situation.
For USB ports:
http://www.lindy.co.uk/usb-port-blocker-pack-of-4-colour-code-blue/40452.html
http://us.kensington.com/html/17084.html
If it's just the fact that the port is empty, you could buy a bunch of RJ45 connectors (or alternatively cut them off the end of old patch leads) and clip them into the ports.
If access is still an issue you could trim the end of the clip so that you'd need a small screwdriver to operate the release.
Many ports can be physically disconnected from the motherboard/card inside the machine by unplugging a cable.
... with a blob of glue to discourage even screwdrivers...