To stop the users from using other keys than the approved "encrypted USB keys", you may add some OS-side filters, as @LucasKaufmann explains. But most ways to filter devices can be worked around; basically, the filter will ask for the device vendor identifier and model, possibly the serial number, and decide whether the device is "allowed" or "not allowed" based on this information. A user could modify a programmable USB device to mimic an approved key, by sending the same identifiers to the machine. This will defeat most filters.
The problem of preventing the use of the approved encrypted keys on other machines than the user's approved laptop or desktop system is dual: this time, any filtering should occur in the encrypted USB key, who should reject "unapproved" laptops. This seems even harder to maintain.
At that point, you might want to shift the problem. From your description, I suppose that you want users to be able to exchange data files between their "approved" laptops/desktop systems, but not with non-approved machines. To obtain this functionality, you might be able to setup a VPN linking the approved machines together, thus avoiding the use of any USB device at all -- at that point, you can then configure the laptop OS to refuse all USB devices altogether (this can be done in software, or in a more physically aggressive way by pouring epoxy glue in the USB ports).
(Of course, if the USB keys have already been bought, or, even worse, using encrypted USB keys is the pet idea of some upper manager, then not using the keys might not be an acceptable option. However, I still encourage you to write down, in specific details, what security properties you are trying to achieve -- namely, the attack model.)