If you can mac-whitelist, you might also be able to use 802.1X in some form, and be it just locking to the TPM chip or some other crypto token your device has a

If you can mac-whitelist, you might also be able to use 802.1X in some form, and be it just locking to the TPM chip or some other crypto token your device has already.