You can block CD/DVD drives using device control with SEP, otherwise you will need to rely on third-party product to either encrypt data written to CDs or block them in some other manner. 

You can block CD/DVDs entirely (both read and write) but you can not make them read-only with SEP (as you could with Altiris ESS; Senforce)? 

I think this can be achieved Via Group Policy as well.

You can also completely disable built in XP CD/DVD writing by
disabling the XP IMAPI service. Control Panel -> Administrative Tools
-> Services ->IMAPI CD-Burning COM Service -> Startup Type ->
Disabled.

Local Computer Policy\User Configuration\Administrative Templates\
Windows Components\Windows Explorer\
Remove CD Burning features

Unfortunately there is not a way for SEP to handle this.  The above GPO configurations do not prevent 3rd party apps from burning but only disables the Windows burning features.