It's been an age since I've tied things down, so there may be a better way
of doing this, but I don't remember there being a way to actually prevent
the use of a drive without physically disconnecting it. What I used to do
was hide the drive from My Computer and disable the run command. There's
two separate settings under User Configuration\ Administrative templates for
this.
