Don't think that's possible with the built-in self-registration.
There's several things you could do though:
- Activate activation of guest accounts by an administrator. Have that admin reject al employee accounts.
- Prohibit the guest SSID via GPO or MDM on corporate devices.
- Dissuade guest usage of the network by setting a low enough splash frequency. Guests won't mind that it's only 2 hours, employees will get tired of it quickly. You could also set application and bandwidth limits.
- Blacklist individual users (devices) on the guest ssid. This is labour intensive and limited to 3000 entries. So scalability is questionable.
- Inform your employees about them not being allowed to use the guest network and periodically check the list of guest accounts. This could be combined with the blacklist from the previous point.
Another option would be to just let them use the guest network...
