What are the limitations of the USB Composite device
You can't have a "HID keyboard" with a "single extra port"; the device of this kind must be a compound device, made of a two-port hub, with one port connected to non-removable HID device. The other port can be permanently connected to a mass-storage device. In this case you might not need to wrap all this as a composite device (a device supporting two alternative classes).

Designing correct set of descriptors for these kind of devices is awfully complicated (at least from a hardware guy perspective), but you can use ready-to-go guides from, say, Keil compiler support, MDK Middleware for USB Device and Host Communication. This link is for an example of composite USB device built upon two their previous tutorials, "USB Device HID", and "USB Device mass storage". I hope this is exactly what you need.