You can whitelist dia deviceID or classID. Neither of them are unique. DeviceID uses the device instance path but a lot of external hard drives same the same DeviceID. How do you whitelist hard drives individually in such cases?
This has been verified using the Viewer?
https://www.symantec.com/connect/articles/how-block-or-allow-devices-symantec-endpoint-protection
what kind of HDD you are trying to block?