You have to use the Firewall in order for that to work.

As mentioned in earlier posts you have to install firewall also Because  Application and Device control' component is depends on Network Threat Protection. If you are having some problem with Network Threat Protection create a allow all rule keep it as the first rule, also keep all clients in server control mode (First do it in a test environment ). If you are having some other problems pls post here.

Ah....that explains it. I will test this further and report back here. Thanks for the help!

Great, it works!

One more quick question: 

How do I add a rule to block .msi's from running off of USB drives? It doesn't seem to do this by default, so I tried adding a "*.msi" underneath the rules, and that didn't work, either.

How to prevent programs from running by blocking the file extension types from removable drives.

 http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009020313373948?Open&seg=ent

 Try setting it to terminate rather than block.

Just to check what happens, can you try with a simple text file insteadof msi? .. Try opening a txt file frm pen drive, after blocking *.txt ... Because if it blocks or terminates explorer.exe, then thats the handle associated with msi .. So, lets see if thats the case fo msi or any other file...

you cannot block msiexec.exe from running

msiexec.exe is still able to Create and Write .exe files when an Application Control Polciy is in place to block all Create, Write and Delete attempts to all .exe Files

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/bdc1ca1f484550176525752e006e8dc8?OpenDocument

The document is talking about exe files which are executed from the USB drive, which inturn calls an associated MSI ... If you want to block installations, you can very well block the msiexec.exe with a md5 fingrprint :)

First create a registry key for blocking it ,then protect that key with application and device control

With Windows Installer 1.1 and later, you can restrict users from browsing MSI files on removable media such as CD-ROMs and DVDs by performing the following steps:
Start a registry editor (e.g., regedit.exe).
Navigate to the HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer registry subkey (create this subkey if it doesn't exist).
From the Edit menu, select New, DWORD Value.
Enter the name DisableMedia, then press Enter.
Double-click the new value, set it to 1, then click OK.
Close the registry editor.
Log off and log on for the change to take effect.
Ref:How can I stop users from installing Windows Installer (MSI) files for removable media?

You can do the same through Group policy also
 configure Windows Installer Group Policy computer options
Managing Windows Installer with Group Policy
For protecting the key refer below figure
block modification to that registry key