Restricting attachments to just staff

Yes, you’re looking for the authorized extensions and authorized extensions for staff settings (admin > site settings). It’s a matter of adding/removing the file types you want to support.