In UEFI, can you disable booting from devices?

When I put the firmware in BIOS/legacy mode, I can easily make it where the boot sequence excludes certain devices.  For example, we make it where the system boots only from the HDD; booting from other devices requires the BIOS password.

Can the same be done when the firmware is in UEFI mode?  So far, I have not figured out a way to limit the boot-sequence devices and putting a password on the excluded devices.  As in the BIOS/legacy mode, I want it where a password is necessary to boot from non-HDD devices.