Prevent documents from being copied to Zip or cloud drives.

I can’t answer that. I just know that is the way you control those things. You can’t just run a couple commands in Terminal.

Apple does have a configuration app that is likely mentioned somewhere in that document. Configurator is an iOS app. I didn’t ever look for a macOS app.

What is your hang up about a network? A Profile is installed on the Mac. The Profile contains the restrictions.

There is no other way to accomplish what you want to do. You have to do your own homework to learn how to create the Profile you need.

There isn’t an easy button.

macOS offers limitation on users via the standard user, parental controls and operational scheduling. If you want to drill down as far as you indicate for control, you likely need a 3rd party app. But keep in mind, not everything is possible just because you want it, and even the most sophisticated app can do no more than what the OS allows.

The profile suggestion seems the most likely solution, but again just because you want it doesn't mean it can be done.

When you figure it out please post back your solution. You were offered advice for accomplishing a unique non-standard configuration. If that advice does not work for you, please post back what does. Criticizing volunteers who want to help you is very non-productive and will get you nowhere.

FtLaudBob wrote:

I figured it out with everyone’s input… and it’s easier than I expected.

I’ll create a user with Parental Controls to restrict web access, access to apps and files. Implement the Firewall as backup. And they sell USB port locks that physically plug the ports for $15 on Amazon. Problem solved. Thank you all for your help.

Good job. Thanks for posting back with the solution.

I don't know if you can prevent using zip unless you just remove it--probably not possible.

I'm pretty sure you can control access to removable drives with an MDM Profile.

Thanks for the suggestion. This is a stand alone system though, not part of a network.

It doesn't have to be on a network. You just have to install a profile.