What USB restricted mode does is prevent the device from trusting new external contraptions, such as dongles for connecting to ethernet, to reset its password. You may recall back when the FBI demanded Apple provide a way for law enforcement to unlock iPads, in a likely attempt to set a precedent so they could routinely frisk people's devices to build evidence for drug charges? USB restricted mode is directly related to that showdown, and when set (by default) you cannot connect to the internet until the device has been unlocked specifically to prevent the iPad from being unlocked remotely by a potentially adversarial party. With rare exceptions, there's very little reason not to toggle that setting in an enterprise since you cannot recover any data if you lose the passcode. You can find the setting in Jamf under Configuration Profiles -> Restrictions -> Functionality -> USB restricted mode and the setting you're looking for is Restricted.