An administrator has correctly created an Application and Device Control (ADC) policy to block all USB ports on the machine. The USB Mouse is blocked, but the USB Keyboard retains full function. The same non-blocking behavior is observed when the Class GUID for keyboard devices is set to block.
Application and Device Control cannot block PS/2 compliant USB keyboard devices. This functionality is by design, as noted in the below documentation excerpt:
This functionality cannot be provided by Symantec Endpoint Protection.