How to block all the USB type devices (e.g. mice, keyboards, USB drives, etc), yet allow a single specific device (such as an Administrator's USB key) to function
Before you create the exception, you'll need to gather the Hardware ID from the specific device.
You must create exclusions for each individual device. If there are, for example, 15 different Administrator USB keys, you will need to create 15 different exclusions, one for each device. The only other alternative to this is to not block all USB devices.
Gather the Device ID of device(s) to exclude using the DevViewer tool: