Application & Device Control - Blocking Apps Running From Smartphone Storage

I'm trying to block apps from running on removable drives. I've got it working for USB drives, but can't get it working for smartphones.

Using the default application control rule set, I can block USB drives by matching USBSTOR\* The default rule of USBSTOR* doesn't work by the way. You have to put the \ before the wildcard *

But when I try something similar for smartphones it doesn't work. I've tried using wildcards at various positions in the id string, and even using the dev id specific to the phone I'm testing with as reported in DevViewer doesn't work.

Does anyone have any tips or ideas as to how I can block apps from running from smartphone storage?