Need to enable CDROM read or write on a per-user basis

Windows XP SP3 and Server 2003 SP2. Is is possible to use Sophos Enterprise Console 4.5 or 4.0 to enable CDROM read or write on a per-user basis? If so, where can I find detailed documentation on this? So far all I can find is very general policy information that only seems to talk about per-device and not per-user configuration.

I need to give some users read-only, other read-write, and default to no access for CD or DVD drives.

Thanks,

--Bruce