How to correctly implement the prohibition of issuing addresses in DHCP?

Question

System administration

There is a domain on windows 2016. There is DHCP which is raised where AD DS is. In DHCP, there are a couple of areas in which you need to prohibit the connection of left devices. Those. sockets are placed in the cabinets, where PCs are connected, there are many free ones. We need to exclude the option that someone brought their laptop / modem / PC, etc., and stuck into our network, having received an address from DHCP.
Now it is implemented simply: I just added absolutely all *.1-254 addresses to the exceptions for issuance and that's it. When I need it, I just add the required MAC to the reservation and the car gets the address. In my opinion, this is a crutch, rather than a special functionality that is designed for this.
How else can the ban be enforced? If we exclude the option with a switch and disable the necessary ports.
Is there any feature in domain roles?

Answer 1

In fact, the best option is to issue static addresses via RADIUS and authorize computers, for example, using certificates + MAC via 802.1x in the same RADIUS.

Answer 2

The ban on DHTsP - protection from fools. True hacker will prescribe IP with his hands)
You need to "extinguish" ports that are not used on switches or use port security;)

Answer 3

802.1x, but it's expensive)