A manufacturing company is concerned that employees may copy files containing confidential product designs from their corporate Windows laptops onto USB flash drives. The security team wants to detect and block these copy actions on the physical devices themselves, without relying on email or cloud upload scanning. Which Microsoft Purview capability should they configure?