5
LAN: authentication and monitor data consumption
(programming.dev)
https://en.m.wikipedia.org/wiki/IEEE_802.1X
But, it's probably far easier to just run a wire guard VPN server, and require every device to connect to the server to get network access. So any device physically plugging into your network would only be able to route to the wire guard server.
Community for discussing enterprise networks and the ensuing chaos that comes after inheriting or building one.