I found the following login script (untested) that will check to see if the user is connecting from outside the office and if they are a member of a certain AD group.  If all passes then they are allowed to print.  If you wanted to disable all external USB printing then just disable the TP Autoconnect Service and the TP VC Gateway Service and they will not be able to print to any type of USB printer including label printers.

• strComputer = "."
• Set objNetwork =
  WScript.CreateObject("Wscript.Network")
• Set objSysInfo = CreateObject("ADSystemInfo" )
• strUserDN = objSysInfo.userName
• Set objUser = GetObject("LDAP://" &
  strUserDN)
• Set objWMIService = GetObject("winmgmts:\\"
  & strComputer & "\root\cimv2")
• Set objShell = CreateObject("WScript.Shell")
• '--------------------------------------------------------
• ' IsMember Function
• '--------------------------------------------------------
• Function IsMember(strGroup)
• ' Function to test one user for group membership.
• ' objUser is the user object with global scope.
• ' strGroup is the NT Name of the group to test.
• ' objGroupList is a dictionary object with global scope.
• ' Returns True if the user is a member of the group.
• Dim objGroup
• If IsEmpty(objGroupList) Then
• Set objGroupList =
  CreateObject("Scripting.Dictionary" )
• objGroupList.CompareMode = vbTextCompare
• For Each objGroup In objUser.Groups
• objGroupList(objGroup.sAMAccountName) = True
• Next
• End If
• IsMember = objGroupList.Exists(strGroup)
• End Function
• '--------------------------------------------------------
• ' Check to see if client logged into external View
  Connection Servers
• ' Disable printing if not member of AD Group
  remote-printing-allowed
• '--------------------------------------------------------
• If
  objShell.ExpandEnvironmentStrings("%ViewClient_Broker_DNS_Name%") =
  "GR1VCSV01.domain.net"
  _
• Or
  objShell.ExpandEnvironmentStrings("%ViewClient_Broker_DNS_Name%") =
  "GR1VCSV02.domain.net"
  _
• Then
• If IsMember("remote-printing-allowed") Then
• echo "Virtual Printing Enabled"
• Else
• Set colServiceList = objWMIService.ExecQuery _
• ("Select * from Win32_Service where Name =
  'TPAutoConnSvc' OR Name = 'TPVCGateway'")
• For Each objService in colServiceList
• If objService.State = "Running" Then
• objService.StopService()
• Wscript.Sleep 5000
• End If
• errReturnCode =
  objService.ChangeStartMode("Disabled")
• end if
• end If