There is a set of Group Policies than can be used to restrict what devices get loaded. You define a list of devices by PnP ID that can load after the lock down is enabled. My paper here discusses the concept: https://annabooks.com/Articles/Articles_IoT10/Windows-10-IoT-DeviceBlock-Rev1.4.pdf.
Note: From the paper, SecureBus is not supported at the moment so stick with the built in solution from Microsoft.
Note 2: Logitech and Microsoft keyboards fit a majority of the market so that leaves a wide open number of keyboards that can be connected.