A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed...

Add each MAC address manually to a blocklist identity group and create a policy denying access

Create a logical profile for each device's profile policy and block that via authorization policies.

Create a profiling policy for each endpoint with the cdpCacheDeviceld attribute.

Add each IP address to a policy denying access.