Hi Jim-
If your users have local Administrative access so that they can install
hardware then they will be able to do this.
The answer (I suspect you know this already) is to not allow local
Administrative access for the domain users.
You may consider editing the security settings in Computer
Management->Removable Storage->Properties->Security and removing or denying
access for all, but this is all or nothing for ALL removable storage. That
would prevent use of CD-ROM as well.
The reason it must be set for all removable storage is that an unattached
device will not appear as selectable to edit it's security.
This is all moot if the users have administrative access since they can edit
the security on Removable Storage themselves (if they know how).