I've done this using separate networks, each device group I want to treat differently get's its own subnet/vlan pair and I firewall the whole vlan. No matter what ips clients have (or even what ips they statically set themself) they can't get past the firewall.

To physically get them connected to the network I use something similar to this config to have one wpa2-personal ssid that leads to multiple vlans depending on the password. Though you could also have multiple ssids with one vlan each or even wpa2-enterprise.

The router doesn't know the IP of android devices (though it doesn't need to), it only knows the vlans of the clients and what network they come from. For all other clients I have dhcpv6.

DNS is on the router and can be set for each network.