How do I enforce charging only on USB and disallow data?
First, don't leave ADB enabled except when you need it,  even though you have to authorize any device that uses ADB, as good safety practice... Other than that, Marshmallow and newer Android do not allow file transfer or other data transfer without authorization on a per connection basis. 

In Marshmallow or newer, I think this is generally an unwarranted concern and usb connection in rental cars can safely be used. TBH, I doubt any legitimate rental company car is of concern at all.