I'd normally suggest diodes sold as TVS diodes (as they will have a somewhat different die layout), but the ones listed on DigiKey all have way too high of a capacitance (1 to 10 nF) for an IO signal. For low-speed and full-speed USB, application notes suggest 5V stand-off, even though the logic shouldn't go above 3.3V. Probably a "standard" zener would be the way to go (like BZX79-C4V7,143 which has ~300 pF capacitance). However, the datasheet of the NXP zeners do not mention ESD ratings.
Another note is that FTDI suggests adding a small capacitor (~47 pF) to the data lines which also helps with ESD.
Double-diode arrangements would work, but require twice as many diodes.
If this were my design, I'd go with a SMD component, as appropriate THT diodes don't seem to exist. Something like ST USB6B1 in an SOIC package should be manageable.