All USB: Windows and Linux block any USB device; a Mac blocks only USB storage. Keyboards, mice, other input devices, hubs, network adapters and card/fingerprint readers are never blocked.
Bluetooth: Windows only. Not supported yet on Mac or Linux.
Thunderbolt: Linux (detect and block) and Mac (detect and alert only). Not supported yet on Windows.
When several policies match: the strictest wins (Block, then Read Only, then Alert, then Allow). Use exceptions to let specific devices through.
Block on Windows: a storage block without exceptions switches off USB storage, so drives never open. With exceptions, each blocked device is switched off a few seconds after it is plugged in.
Read Only: storage only. On Windows a policy without exceptions protects every USB drive the moment it is plugged in; with exceptions each drive is set read-only a few seconds after it appears.