Configure only "trusted" usb flash drives to be allowed to the workstations through Itnune?

Yes, this is what Intune device control is for, and it only touches removable storage, so keyboards, mice and other USB classes are not affected. Roughly:

• In the Intune admin center go to Endpoint security > Attack surface reduction and create a Device Control profile for Windows. This needs Microsoft Defender Antivirus running as the active antivirus on the devices.
• First define your trusted drives as a reusable setting group (Endpoint security > Reusable settings). Match them on vendor and product ID, or on serial number or instance path if you want to allow only specific units. The vendor of an encrypted drive usually has a fixed vendor ID, so one group can cover the whole model.
• Then add two rules to the profile: an Allow rule for that group, and a Deny rule for all other removable storage. Order matters, so put the Allow rule above the Deny rule.
• Assign it to a pilot group first, plug in a trusted drive and an untrusted one, and check that the trusted one mounts and the other is blocked.

The older route is Settings catalog > Device Installation restrictions (allow by hardware ID, prevent everything else), but that affects every USB class unless you also allow the device setup classes you need, so for your goal device control is cleaner. Note that vendor IDs can be spoofed, so if you need strong assurance, also require BitLocker To Go encryption on removable drives.