Normally you can add static leases for all the whitelisted MAC addresses to the IP -> DHCP Server -> Leases table, then set the Address Pool parameter of the DHCP server instances to static-only. Don't create any pool. This should achieve what you need.
To prevent this, turn on the "Add ARP For Leases" option in the DHCP server instances, then go to the setting of the bridges and VLAN interfaces and set ARP mode to reply-only. With that configuration someone with not whitelisted MAC address manually setting their IP address will not be able to talk to the router, and thus will not have internet access (can only talk to devices in the same subnet/same layer 2).