Deny Traffic by MAC address

Hello,

I’m going to be switching a Motorola Canopy network from a Cisco router to a Mikrotik router. I’d like to be able to deny users access to the network (from the LAN side) if their MAC address isn’t registered somewhere. I don’t plan on running NAT because each end-user will have their own public IP address.

What’s the best way to accomplish this task?

Thanks!

make ARP tabele static
then when want to stop just change MAC address of user

Configuration example:
http://wiki.mikrotik.com/wiki/How_to_secure_a_network_using_ARP