How to properly configure AD network security?

Question

Active Directory

We have an AD+DHCP+DNS server, the gateway is Squid (MikroTik is in front of it).
Please tell me how to protect the domain network from people who can simply plug their PC (or via WiFi) into an Internet outlet and access the network?
As an option - you can give everyone the address statically with binding to the MAC, but I think there is something like arp-tables protection?
Thank you!

Answer 1

at least block unused ports on switches (it won’t help with Wi-Fi),
as an option on ports, raise port security, but again, it won’t help with Wi-Fi
Stops using 802.1x :)

Answer 2

your PC (either via WiFi) to an internet outlet and access the network?

It will get an IP on your network, but not access. The computer is not in the domain. Prevent the local administrator from entering the domain. Disable direct internet access. Do not process untrusted computers on the proxy server.
I was kidding like this: for the left MAC, I gave out addresses via DHCP, which the router closed on itself.