Optiplex 790 with BIOS A13 - UEFI boot security issue

I'm staging Optiplex 790 devices for public use.

Test machine has BIOS version A13 installed.

In BIOS, General -> Boot Sequence, I've unchecked all devices on Legacy list except hard drive.  There are no UEFI devices listed.

With an Admin password set, if I boot and press F12, the Onboard NIC and CD/DVD still display, although they require the admin password to boot from.

 

Next, insert a bootable disk into CD/DVD drive, reboot and press F12

Now, a UEFI device for the CD/DVD drive is displayed in the list which does not require the Admin password.  Select this and the machine boots from the CD/DVD.

I've tried booting with disk in, press F12 and enter BIOS.

Under General -> Boot Sequence:

I've clicked on UEFI radio button;

Unchecked the (now-detected) DVD drive;

Apply;

Click on Legacy radio button;

Apply

Exit.

While disk is still in, reboot and press F12.  UEFI device displays and requires a password,

 

However, removing disk -> boot -> insert disk -> reboot -> press F12

UEFI device again displays and does not require an Admin password.

 

This is a HUGE security issue to us, as it allows anyone to boot off of an install disk or LiveCD/DVD.

I'm not finding any other BIOS settings to disable UEFI boot devices.

For several reasons, we don't want to set a System password.  It's just not practical or functional in our situation.

 

So, how do I disable booting from any possible UEFI device?

or, at least, require Admin Password?

 

TIA

Rick