How to disable USB and Audio via Global Policy, Active Directory, or other means

SHORT VERSION
I need to disable audio (including the USB headset) for one domain user and would prefer not reduce permissions to other users of this machine on the domain.

LONGER VERSION
I have one user of the domain that needs to only be allowed to use a particualr machine (already have that set up), during particular hours (Again, already set up), for a particular task (using internet explorer, hitting one primary website, and using Google search to gather information from other websites).  Other users are allowed to use this machine normally (with audio, flexible hours, etc), but for a SPECIFIC user I would like to diasble audio (via speakers/sound card/CDs,/etc) and disable USB (for USB headset, and can trash thumb drives, etc).

THanks,

Ted