To still protect your Mac from starting on untrusted external media, you can set a firmware password, available on macOS Mountain Lion or later. A firmware password prevents users who do not have the password from starting up from any media other than the designated startup disk.
<strong>If you forget your firmware password you will require an in-person service appointment with an Apple Store or Apple Authorized Service Provider.</strong>