From the wording, it seems like it should be an option to prevent the devices from being added, or if they are added, preventing them from actually being enabled. One of the options can be found here http://www.stigviewer.com/check/ESXI5-VM-000034
I'm familiar with the cmdlets for removing hardware after it is added, but this is proactive measure. Thanks for the response. My main issue is why the options don't show up when I type
(Get-VM "Name").extensiondata.config.extraconfig. It just seems odd, but again, I may just be doing something wrong.