No, you do what he explained. Those DBs might have access to the customer DB, but no USB on those system.That access would also be logged at another location, listing date/time/user. It might also require a sign off from a manager/team that reviews record access of more than say 10,000 clients, etc. DBs would be informed of all these security factors, to desuade individuals from making bad choices.

Individually, none of the above would stop this kind of breach. Altogether, and it might be enough. You amply defense in depth