https://www.linkedin.com/pulse/disable-booting-from-usb-external-drive-mac-os-stefan-fekete/

How to on Apple T2 Security Chip :
1.Turn on your Mac, then press and hold Command (⌘)-R immediately after you see the Apple logo. Your Mac starts up from Mac OS Recovery
2.When you're asked to select a user you know the password for, select the user, click Next, then enter their administrator password.
3.When you see the macOS utilities window, choose Utilities > Startup Security Utility from the menu bar.
4.When you're asked to authenticate, click Enter macOS Password, then choose an administrator account and enter its password.



These Mac computers have the Apple T2 Security Chip:
iMac (Retina 5K, 27-inch, 2020)
iMac Pro
Mac Pro (2019)
Mac Pro (Rack, 2019)
Mac mini (2018)
MacBook Air (Retina, 13-inch, 2020)
MacBook Air (Retina, 13-inch, 2019)
MacBook Air (Retina, 13-inch, 2018)
MacBook Pro (13-inch, 2020, Two Thunderbolt 3 ports)
MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports)
MacBook Pro (16-inch, 2019)
MacBook Pro (13-inch, 2019, Two Thunderbolt 3 ports)
MacBook Pro (15-inch, 2019)
MacBook Pro (13-inch, 2019, Four Thunderbolt 3 ports)
MacBook Pro (15-inch, 2018)
MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)