Is it possible to set up Mac OS X 10.8 (Mountain Lion) on a MacBook Air so that users cannot boot from external media (e.g. a USB memory stick) and cannot restore the OS from the internal restore partition?
The secure way is to set up Firmware password.
That will block any attempts from booting from outside, but it will require you to enter the password when booting up.
Here is a sample what it does:
How to do it: OS X Lion and Mountain Lion come with OS X Recovery > http://support.apple.com/kb/HT4718
This allows you to reinstall OS X, browse the web, repair drives and set up a firmware password, too.
First of all, hold Command and R keys while your computer is starting to start in OS X Recovery.
Then, go to Utilities menu (on the menu bar) and open the Firmware Password Utility, which will allow you to set up the firmware password.
Don't lose it because it's not possible to reset it without knowing this firmware password