Disable Thunderbolt ports in macOS Mojave to mitigate the Thunderclap vulnerabilities
The best way to do this is to move away those kernel extensions completely. This means that they're never loaded during boot - and thus you do not have a "gap" where the computer is vulnerable during the time between boot and the time where you run the kextunload commands. In addition you do not have to deal with dependencies for unloading them.

The necessary steps are:

1) Boot the Mac in Recovery mode (boot the Mac with cmd-R pressed). 

2) Open Terminal

3) Disable SIP by running: 

  csrutil disable


4) Create a folder to contain the disabled extensions:

  mkdir /Users/&lt;username&gt;/ArchivedExtensions/


5) Move the kernel extensions you want to disable away by running:

  mv /System/Library/Extensions/&lt;name&gt;.kext /Users/&lt;username&gt;/ArchivedExtensions/


6) Re-enable SIP by running:

  csrutil enable


Note that  should be substituted with your username, and  should be substituted with the extension you want to disable. You can run the command multiple times with different names to disable more extensions.

The relevant extensions you can disable are:


AppleThunderboltDPAdapters.kext  
AppleThunderboltEDMService.kext
AppleThunderboltIP.kext 
AppleThunderboltNHI.kext
AppleThunderboltPCIAdapters.kext 
AppleThunderboltUTDM.kext
IOThunderboltFamily.kext