In the first case are we talking about malicious activity/corporate espionage? Or stupidity/negligence? (both are real issues).
In either case, start with making a note of what information sharing is needed to get the job done (remember the IT tail should never wag the business dog) and a workplace HR policy that spells out that this is all that is allowed and that infractions are disciplinary matters.
In addition to this, remember that employees are human - unless you're working somewhere that clearly and obviously requires draconian security polices then going over the top will alienate the staff and harm productivity - remember you're not securing the system because securing the system is good fun, you're doing it to protect the business. Part of protecting the business includes not annoying and disrupting employees for no good purpose.
Lastly, in terms of the "setting policy" points, remember that IT Security does not exist in a vacuum. There is little point in locking down the network if physical security is lax. Why would someone need to break into the network if they can just walk into an office and pick up the data in a nice little printout, hide it inside their lunchbox and walk out?
If you don't want people in one department talking about confidential business to people in another department then again, this needs to be made clear to them. Again, there is little point in locking down the network if someone can just buy a friend lunch and ask them about it.
Make sure printers and photocopiers are appropriately secured - people leave all kinds of documents sitting by the printer. And printers and photocopiers sometimes retain a copy of the last printed document in their memory...
As for the actual IT side of things...
Your 6 points are a good starting point but there's a few things to be aware of here:
Configuration lock-down and management is a good start, but how does information legitimately arrive at and leave the business? Can these workflows be abused?
If you're blocking up all the USB ports then how does the mouse work? These are usually USB these days after all. If you leave one port for that a determined thief could unplug the mouse and plug in a USB drive. So perhaps you need to consider software based blocking that prohibits the installation of certain classes of device.
You need to consider sophisticated email filtering if you want to go down that road. Rather than just assuming that any files over a certain size are to be blocked as bad, you need the sorts of email filtering that are available that scan content for keywords and patterns you define and take actions based on that.
Separating sensitive offices VLANs (if not totally physically separate networks) is good standard practice. Be aware that this will increase support costs and may be prone to breaches due to human error on the part of the support technicians who do the wiring.
One thing I would certainly do is ensure that data wasn't stored locally on workstations and laptops but rather saved onto central severs. These should be easier to secure both physically and electronically. Consider storing documents in document management systems that enable you to track access and changes made. This can also allow for IRM to control who can do what to a document. These systems aren't foolproof but can help.
There's a lot more things you can say about this subject but these might give you some interesting thoughts. It's a subject that you can write a book about (indeed several people have).