How to restrict access to the Internet if the company is not in DHCP Leases?

Question

Computer networks

Greetings! I recently came across Mikrotiks and networks in general, I myself am setting up something in RouterOS, but I still don’t understand much, please explain on your fingers.
On the router from Mikrotik, I want to restrict the Internet (WAN) to one specific computer (by MAC address, apparently). But it is not in DHCP Leases. On the computer itself, ip is configured manually, and it is from a different subnet. Namely: The
router distributes ip like: 192.168.88.***
On the computer, ip is configured like this: 192.168. 1.10 In this case, the DNS server on
the computer is manually set to 192.168. 1.1, although I configured the router's ip as 192.168. 88.1 , but it also opens at the first address.
QUESTIONS:
1) How to restrict access to the Internet if the computer is not in DHCP Leases on the router? (in case I decide not to change the ip on the computer itself)
2) How to clean up the network? And now everyone can set up their own ip, I won’t see it on the router (in DHCP Leases), and he will be able to do whatever he wants uncontrollably ...
3) How to limit the ip on which the router will open / DNS will work? And it’s also not the order that it works on different ip, probably ...

Answer 1

For the first and second points:
Set add-arp=yes on the DHCP-Server.
Set arp-mode=reply-only on the desired interface.
At this stage, the router will not write an automatic ARP entry in the interface for each poppy, and a person with manual settings will simply not receive anything, because he will not be able to in layer 2. DHCP-Server, issuing addresses, will add entries to the ARP list and these users will be able to work as intended.
The third point needs more specifics. If you are interested in logging into the device, then in System>Users there is a field Allowed Address , which allows you to restrict the login to the router to certain addresses.

Answer 2

1) In this scenario, a person no longer has the Internet. His network 192.168.1.x is different from yours 192.168.88.x
2) Find, beat hands, raise a domain, take away admin rights from everyone, install managed switches with IP-MAC-Port Binding
3) Start with books on networks, go to some thread training courses.