Charging-only when locked with BFU exception will be the potential default. If you don't use accessories when BFU then Charging-only when locked works, if you don't use accessories at all then Charging-only is best.

If any USB port usage by someone is unacceptable like in a threat with physical access, then Off is best. This makes the phone only charge when you power off. Hopefully forces them to go to BFU state.