You should create 2 user assignment groups:
- group 1: all users with CD writers and CD readers exluded
- group 2: CD readers
And you should have 2 rules:
- rule 1: block CD/DVD devices -> apply it to group 1
- rule 2: read-only CD/DVD devices -> apply it to group 2
Monitor/notify user is optional in both rules but good to have.
Hope this helps.