What is a firmware password?
A firmware password prevents users who don’t have the password from starting up from any internal or external storage device other than the startup disk you’ve selected. It also blocks the ability to use most startup key combinations.
To create a firmware password, start up your Mac from macOS Recovery by pressing and holding the Command and R keys immediately after turning on your Mac. When the macOS Utilities window appears, choose Utilities > Firmware Password Utility (OS X Mountain Lion through macOS Sierra) or Startup Security Utility (macOS High Sierra or later). These utilities are available only on Mac models that support use of a firmware password. To learn more, see the Apple Support article How to set a firmware password on your Mac.