Katokato the info at link although interesting didn't help as I tried it and the behaviour was exactly the same as that when I modified UBSTOR permissions in the registry. Although the functionality of setting "Start" to 4 in the USBSTOR registry entry did behave as described.
However I did a bit of lateral thinking in that the USBSTOR key points to the driver
USBSTOR.sys in \Windows\System32\Drivers
\ so I tried modding the permissions here, although it wouldn't allow this. Going into Advanced options I saw the "Owner" was "Trusted installer" so I changed this "Administrators" and set all permissions to "Deny", re-booted and hey presto any new drives fail to install whereas previously installed drives still work - these can be uninstalled manually if access is to be denied in the future.
I'm guessing the ownership issue was causing the previously observed behaviour (although I didn't get an error changing the permissions in the registry).
Anyway thanks for the link, I thought I'd never get an answer but between us I got there!