Mám řešení přímo od MS, pokud tedy PC není v doméně a jde o lokální účty. Je to docela jednoduchý:

To prevent users from connecting to USB storage devices, use one or more of the following procedures, as appropriate for your situation.

If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:%SystemRoot%\Inf\Usbstor.pnf
%SystemRoot%\Inf\Usbstor.inf
%SystemRoot%\Inf\Usbstor.pnf
%SystemRoot%\Inf\Usbstor.inf
When you do this, users cannot install a USB storage device on the computer.