You have five tile servers that run Windows Server.

In the Administering Windows Server Hybrid Core Infrastructure materials for file services, Microsoft emphasizes using File Server Resource Manager (FSRM) to control which file types users can store on shares. FSRM provides File Screening Management that “controls the types of files that users can save” on a path by matching file groups (extensions) and applying either active screening (block) or passive screening (allow but report). The guides further note that you can “create file screen templates to standardize settings and apply them to multiple folders or servers,” minimizing repeated administration across many file servers.

To meet the requirement “block users from uploading video files that have the .mov extension… All other types of files must be allowed,” you create a File Screen with Active screening on the shared folders (or their parent paths) using a File Group that contains *.mov. This directly prevents writes of the specified extension while permitting other files.

By contrast, Dynamic Access Control (DAC) central access policies/rules govern authorization based on claims and resource properties, not file extensions. A DLP policy targets Microsoft 365 workloads and sensitive information types rather than enforcing extension-based blocking on Windows Server SMB shares. Therefore, the least-effort and purpose-built solution is an FSRM file screen.