I have two questions regarding the storage policy. (USB storage devices are disabled an I manage the whitelist)

1. Should I assign the policy to a device or to an user object?

2. If I manage the Preferred Device List, how many devices can I add to this list, or how many devices are a reasonable number?