I have a set of Linux workstations that only approved users should be plugging in approved USB storage devices. How can I restrict mounting new USB devices to certain groups? And is there a way to reject unrecognised devices?
You probably want to look into a piece of software called USBGuard. It's designed specifically for handling this. Unfortunately it's not pre-packaged for many distros, but it is pretty easy to build locally and you probably already have most if not all of the dependencies installed on the systems in question.
A custom solution is also possible, but ironically your best reference on how to do that is probably also USBGuard.