You can set the interface in question to disabled=yes ... this will disable the interface immediately, but will stay disabled after reboot ... until you manually enable it again. Just make sure you don't disable interface you need for management access ...
This is not what I'm looking for. What I want to achieve is like a simple login rule. Just after powering on device it is disconnected unless administrator connects it manually and device is connected to the AP until administrator disconnects it manually or power it off or reboot it. Administrator doesn't always disconnect device after use and it may be disconnected anytime without any notification, so the next time device is powered on, it should be disconnected.
Why this feature is important? It can prevent unauthorized person to sneak into defined network by disconnecting ethernet cable from antenna and connecting their own cable to it.