Another strong option is to use 802.1x. You wouldn't want hubs in your network if you want security, but you would always disable 802.1x for a port going to a hub (so there is no protection). You can then authenticate a machine against AD, or even use Meraki Authentication if they are small. https://documentation.meraki.com/MS/Access_Control/MS_Switch_Access_Policies_(802.1X) 802.1x is the "gold" standard.
... View more