Following @Ramhound's suggestion, I got it working using group policy.
The general direction is documented here: https://technet.microsoft.com/en-us/library/2007.06.grouppolicy.aspx
In particular, the "Prevent installation of removable devices" rule is what I need.
So here's a summary of what I ended up doing:
- In Device Manger, uninstall all USB devices that I don't want, including the ones that are currently not connected - there's an environment variable called
DEVMGR_SHOW_NONPRESENT_DEVICES that enables the display of installed, but currently disconnected devices; just search the web for "DEVMGR_SHOW_NONPRESENT_DEVICES";
- Install the USB device that I want; in this case, a USB mass storage device;
- Enable the "Prevent installation of removable devices" rule in Group Policy.
- Group policy probably can't effectively block some devices that don't expose a unique serial ID. E.g if a certain vendor model of USB mass storage device doesn't expose a unique serial ID, and you have installed one, then group policy might allow any other instances of the same vendor model to be mounted. I don't have such a model of USB mass storage device with me, so I can't really verify.
- As far as I understand, USB device IDs are not signed and thus cannot be verified - i.e. if a USB device claims to be a certain device, with a particular serial ID, there is no way for the computer to tell whether that's true. A bad guy could build a USB device with forged USB device ID and forged serial ID, in order to get it accepted by you computer, though even then.
With all that said, this solution works if you assume that all your devices expose unique serial IDs and that nobody tries to forge a USB device to get it accepted by your computer.