set ip arp to reply-only and register mac adresses you want to authenticate with your PPPoE service
Setting ARP to 'reply-only' will probably not help in this case. The functionality of ARP is only relevant for the IP
protocol (as is provides a mapping of MAC addresses to IP
addresses) but the MAC layer protocol in this case will be PPPoE and not IP, therefore ARP will not be used anyway (PPPoE itself does not need nor use any ARP requests, and IP, which would need them, will be flowing over PPPoE, which will provide Point-to-Point interfaces to the IP layer, and a Point-to-Point interfaces does not require ARP either).
If Radius is used then the MAC address of the connecting client might be available as an Access-Request attribute (probably Calling-Station-Id or something like that) and it could be used as a Radius Check-Item to either permit or deny a connection for that client.