You could try either or both of these in the VMX

By USB Class
usb.numClassRestrictions = "n"
usb.classRestrictions1.allow = "FALSE"
usb.classRestrictions1.classID = "USB Class ID"
usb.classRestrictionsn.allow = "FALSE"
usb.classRestrictionsn.classID = "USB Class ID"

By Device
usb.numClassRestrictions = "n"
usb.DeviceRestrictions1.allow = "FALSE"
usb.DeviceRestrictions1.vendorID = ""
usb.DeviceRestrictions1.productID = ""
usb.DeviceRestrictionsn.allow = "FALSE"
usb.DeviceRestrictionsn.productID = ""
usb.DeviceRestrictionsn.vendorID = ""

I tried the Class restrictions and it seemed to worked on Workstation Pro 16.2.5 on an Ubuntu host
usb.numClassRestrictions = "2"
usb.classRestrictions1.allow = "FALSE"
usb.classRestrictions1.classID = "0xE0"
usb.classRestrictions2.allow = "FALSE"
usb.classRestrictions2.classID = "0x08"

This disallowed connecting bluetooth module (0xE0) and USB flash drive (0x08).

I would think USB Ethernet class ID would be 0xEF; see this https://www.usb.org/defined-class-codes

The Class would be broad and blunt while the blocking by Device would be like a game of whack-a-mole.

You might also try setting it in the config file for machine-wide setting instead of vmx so that it doesn't have to be applied for every VM.