Assuming the portables are downloadable from a whitelisted website. Or that your USB ports aren't configured to encrypt anything you insert. McAfee, I'm looking right at your ugly endpoint encryption...
I'm assuming you haven't had the joy of working with McAfee Ednpoint Protection. When you insert a USB device, it automatically encrypts it. Our BIOS are locked down to prevent anyone from monkeying with the desktops. Same with notebooks. Hell, we even encrypt CDR/DVD disks that are writeable...
It's really easy to do if you need it.