When users delete a file using the 'Delete' key, the explorer.exe goes over each storage device having a Recycle Bin (RB) on it (even though the file is deleted from the device that does not have a RB), checks the $RECYCLE.BIN folder ($RB), and if the folder does not exist, it creates such folder for the current user.

So when MEPP policy forbids writing unencrypted data to storage devices, and there is no $RB for the current user on the device (and the Explorer "thinks" that there should be a RB on the device), it tries to create such folder when some file is deleted through a Delete key. That is why the "Access Denied" message appears.