USB controls are a system design problem

Blocking USB devices outright breaks legitimate work, so the answer is rarely a simple prohibition.

It needs a designed route: issued encrypted devices, scanning stations, a sanctioned way of moving files that is easier than the unsanctioned one. In industrial environments removable media is the ordinary way updates cross an air gap, so the control has to accommodate the work rather than forbid it.