There is no method to allow a device without the SM profile/payload to natively block it from the network without a particular app. There would be a way if you had MDM installed. You could create a policy to make the application mandatory, if they uninstalled a dynamic tag could change the network group policy to (block and pop a webpage, or other options) if the app wasn't installed. Once again this requires SM to be installed on the phone. If this is something your interested in I could elaborate further.
