Yes, you can choose not to release USMLE step 2 scores (not sure about comlex) assuming that at the time of your submission to ERAS, your scores have not yet been released...when you tell it to submit USMLE scores, it releases everything reported as of that date. You can check a box to NOT automatically transmit additional scores that come in. So if you check this box, you can either manually release your scores if you decide you want PDs to see them, or you can not release the step 2 scores at all (though PDs may ask for them at interviews).
The latest you can take it is up to your school...some schools require you to take by Dec 31st, some require you to pass it by Dec 31st, some require you to pass it by the end of the school, some require you to only take it by the end of the school year and not pass it. Find out from your school what its policy is. You can take it after the match if your school finds it acceptable. I did. You do have to take it prior to starting residency for 99% of cases.