The real problem is not the unprotected USB port, the real problem is that your device puts you and your devices at risk of being connected to higher-voltage, relatively high-current sources.
You can solve transient overvoltage with clamping diodes, but these won't help if you power supply is strong enough – they will just fail, and then you're in the same situation as before, only milliseconds and the smell of burnt semiconductors farther.
Your problem is a bad one, for a lot of reasons, and your laptops are the least of that:
USB is meant to be handled manually (that's redundant wording), so if this fault kills your laptop, I don't have the strongest confidence that it's inherently save for human interaction.
There is, for good reason, design criteria for circuitry that involves switching higher voltages with lower voltages.
Generally: you need galvanic isolation between whatever any human (even a service technician) could touch during operation and the dangerous voltages.
Hence: strictly separate your USB controller and the things it switches. It's common practice to drive inductive or high-voltage loads using optocouplers, whose secondary side is driven by a separate power supply.
The board layout must make the high-voltage regions separate from the 5V/MCU environment. Only optocouplers, transformer cores, and relays can be allowed to cross that boundary. No compromises.
A typical problem is that your device's power supply ground has a completely different potential than the USB ground – though that should not be an issue for a laptop, which itself should be galvanically separate from anything else, there's a lot of cases where you run into trouble with that (e.g. laptop ground ends up on ethernet ground, audio ground, RS-232 ground...). The strict separation (isolation) between controller and controlled makes that an inherent non-issue.