Firstly is application & device control installed on all your SEP clients?
In the application & device control policy > Device Cntrol in blocked devices click Add > All USB Devices > OK update the policy on the clients and see if that then works.
You can then add exclusions below that for device ID's or device wild cards you then want to allow to be able to be used