Organization of an enterprise network with limited access to the Internet?

Question

Network administration

Access to the Internet is provided through the software gateway pfSense + Squid + 2 providers.
Access control by IpAddress. It suited while there were static addresses. With the growth of users, of course, everyone began to receive via DHCP. There are no problems with authorization of domain users in Squid. But how to rebuild / reconfigure / implement access to mobile (not domain) users (Linux, iOS, Windows), and there are + -50, to the Internet and to some local resources?

Answer 1

All mobile devices in a dedicated vlan.
If wireless networks with full Internet access are intended, then there should be separate SSIDs for use by "restricted" clients.

Answer 2

For non-domain users, there is Squid basic authentication.

Answer 3

It doesn't take much to expand the question!
What is a non-domain user, is it a gadget that the user has access to also in the domain or are they guests who came to the meeting?