Copilot for Microsoft 365 Security and Governance AMA

Are there recommendations or guidelines on the best way to add Copilot restrictions to an organization's Data Classification Policy? Should Copilot be specifically mentioned in the DCP? Is it better to have a seperate Acceptable Use of AI policy that outlines which data classifications are acceptable to use with Copilot?