Just like I said in my reply to your other, similar post, you can block devices based on the hardware class and hardware id (GUID) and only allow what you want to allow.
If you're lucky and only allow certain removable media flash drives, and they all get the same drive letter when attached to the machine, you can then use a file/folder access control rule to make them read-only. Alternatively, you can use host integrity policy that has built-in "make RM read-only" rule and specify a condition that it's triggered on -- this would be something you need to figure out locally, maybe presence of a reg key that gets created when RM device is plugged in?
Much easier would be not using SEP and use a device and port control application, like Safend's Port Protector, which is built specifically for what you're trying to achieve.