USB device with 2 ports - how to protect against user plugging in both

As pointed out, you can't directly connect two hosts to a device - so if you just wired them together and somebody plugged it in on both ends, you'd have a problem.

However you also have a problem if only one end is plugged in. USB, especially high-speed (480Mbps) mode is controlled impedance. If you wire both connectors data lines together you end up with what is known as a stub in high frequency design. The cable going to the unused connector will degrade the performance of the active connector.

To do this properly, you want a multiplexer IC. You can buy dedicated USB2.0 multiplexers designed specifically for this sort of application - something like the TS3USB30. That would allow you to connect the data lines from both ports to the mux inputs, and connect the output to your device internally. The mux will disconnect the unused connector which will disconnect the transmission line stubs.

For power I would probably use a power multiplexer such as a diode OR-ing circuit. The VBUS line from one of the ports (before the power multiplexer) can then be used as the input to the data multiplexer.

Ground would be common (connected) between the two USB ports and your device.

Multiplexer as suggested by Tom Carpenter is a good solution.

But for full speed USB (12 Mbps), the stubs in the signals are not particularly important. If the distance between the stub ends remain below 1/10th of wavelength, i.e. below ~2 meters, the reflections will not distort the waveform much.

Also, the voltage levels on D+ and D- pins will remain within the acceptable range, so there is not much risk of electronic damage to either host.

The main problem that remains is if you connect the +5V pins from both hosts together, there could be large currents involved. You could use a diode from each USB connector's +5V pin to only let current come in, never out.

The lazy electronical design way would just be to use a physical multi connector switch to choose between which one is used.

Note that this would have the added benefit of being able to leave them both plugged in and use the switch to select which input is to be used.