In case the asterix (*) condition doesnt work as a wildcard filter, you can also try the Ampersand ($).
Create a rule as given above, and mark in the following manner - *mp3* or $mp3$
Ideally, the steps given by @ jrudbecka should work without any hitch. In case you are setting the App/Dev control policy for the first time, once you commit the policy, the clients on which the polcy is being applied HAVE to be rebooted for the first policy to take effect. Any change that you make to the Policy later on, or in case you add any new policies would work just fine w/o a reboot.