You setup DHCP server to add arp for leases
/ip dhcp-server set "DHCP-Local" add-arp=yes
=> the router will add ARP lease for every DHCP IP address
Than on local bridge you setup arp to reply only
/interface bridge set "LAN" arp=reply-only
=> This means that router will reply only to ARP entries in the table (that the router added, when issued IP address via DHCP server).
This will not prevent users to add static IPs in network, but if they will add static IP, they will not be able to access default gateway and internet.
For some extra-security you can set in DHCP server setting pool to "static-only". And evrytime somenone whant to connect to your network you change the pool to the "LAN - pool", make the DHCP lease static and change back to "static-only" so even it somenone that you dont want to, connect to network wont get the IP address, and even if set up the static ip, will not be able to access internet.
If you want to go even further you can even set /32 mask for every client.