Computer mode to User mode

We currently have all machines set in user mode.

When SEP was installed, we moved the machines into two different groups, laptops and workstations.

This enabled us to set differing policies.

Now, we want to block USB for all users, except a couple of admins.

I convert a machine to user mode, and move this user to a group that allows USB access.

If another user logs onto the same machine, they end up in the same group that allows USB access.

Why doesn't the user go to the Default Group?

Is there any way to assign the group that new users get automatically assigned to?