I added
allow with-interface equals { 08:*:* }
to my rules.conf as per the example. My USB mass storage is still not allowed by default.
If I add the more-specific:
allow with-interface equals { 08:06:50 }
then the USB mass storage I have works.
This looks like wildcards do not work as expected.