You can configure an external drive in policies to automatically start a virus scan when it is connected to the computer. This way, users can only access the drive when the scan is complete and no malware has been found.