In terms of authenticating onto the network, you would need to implement a RADIUS server. That way you can restrict only specific devices to join.
Otherwise you can assign group policies based on device type (after authentication). That way you can assign a real policy to workstation devices and a policy that black holders traffic to all other devices.
Personally I would go the first option. Although more complex, it is much cleaner.