Or you could have two SSIDs with the same name, one available 9:00-17:00 with only the prescribed devices allowed and the other available 17:00-9:00 that is available to all. The devices would need to reconnect at 5pm when the networks switch over, but this might be pretty seamless.
If my answer solves your problem please click Accept as Solution so others can benefit from it.