how to create device group in intune?

I have a policy where the client wants to block USB and it's requirement is that it's assigned to some devices in included groups and in excluded groups want to block other devices. how to do this ? ...