802.1x can do this.
https://documentation.meraki.com/MS/Access_Control/MS_Switch_Access_Policies_(802.1X)
"When an 802.1x access policy is enabled on a switchport, a client that connects to that switchport will be prompted to provide their domain credentials. If the RADIUS server accepts these credentials as valid, their device will be granted access to the network and get an IP configuration. If no authentication is attempted, they will be put on a "guest" VLAN, if one is defined."