You can use Group Policy to limit access to any drives you want, so even if they get a removable drive in the USB port, they will not be able to access it at all (it won't even show a drive letter in ...