the CSE's can be pushed out but for this,
so you import the ADM into a GPO, you should see Custom Policy Settings then Restrict drives
In the group oplicy editor go to View >> Filterint make sure to uncheck "Only show policy settings that can be fully managed"
On restrict drives you should see Disable USB as a choice. I'll take a screenshot from my lab later if you still can't see it.
Thanks
Mike