There are two passive ways of disabling the external JTAG port: one is temporary and the other is permanent. The temporary method is to add the set_property BITSTREAM.GENERAL.DISABLE_JTAG YES [current_design] option when using the write_bitstream Tcl command in the Vivado tools. In this case, the external JTAG port becomes disabled after the configuration bitstream is loaded. This method also disables the internal MASTER_JTAG port.
The Vivado hardware manager can program an eFUSE bit (namely, the FUSE_SHAD_SEC[3] bit in the FUSE_SEC register) to permanently disable the external JTAG port. This method effectively disables the external pins and turns them inside to the FPGA logic. This is effective as an external JTAG disable if authentication is required or if the only time the JTAG disable is required is while the user design is loaded. This would most likely be done as one of the last steps in a production facility so that JTAG-based boundary scan could still be used on the circuit board for testing prior to the programming of this eFUSE.