How can I make a device that will remotely disconnect an Ethernet port?
It may be quite some trouble to find a relay formally rated with the needed bandwidth, and design the system to maintain characteristic impedance throughout, though in practice you may find that an ordinary one and not worrying about that works.  With some thought, you could probably make it work by interrupting only one or two lines rather than all of them.

A lot of professional-grade network equipment does have the capability to enable/disable ports on remote command, often used precisely for the case of isolating infected machines which you mentioned.  Even a consumer grade device such as a wifi router running customized firmware could probably do so at least on the scale of all of its downstream ports; though you'll have the added headache of making sure it's wifi is disabled.  Atmel used to off an embedded linux evaluation platform for their AVR32 chip with dual ethernet configured as a gateway - one of those would do the job if you can still get one.

And there's always putting a locking cover on the box.  This has some advantages in that securing it becomes part of deploying/removing the kiosk, and also that there's a chance staff would notice if the cover were left open.

Finally realize that securing the physical network should be only the first line of defense.