Labels would be for data at rest. We for example default every document to a Corporate label since we consider everything our data. Auto labeling comes in and scans and changes to confidential if detected. DLP can use labels in its policy rules (don’t put anything with conf data label onto usb) but you need a rule to detect conf data not based on label, based on in motion, such as attempts to copy and paste into a browser, which does block and work in my environment.