I've managed quite a few, but typically you would want your "trusted" hosts on a separate VLAN or subnet from untrusted ones. It's probably fine to leave DHCP

I've managed quite a few, but typically you would want your "trusted" hosts on a separate VLAN or subnet from untrusted ones. It's probably fine to leave DHCP DNS Dynamic Updates turned on as long as it's not updating a DNS server with control over any trusted domains. As you say, a host could spoof a MAC and get a reserved assignment, but only if the real host with that MAC is down. Again, isolating the security perimeters is the answer.