A regular registered-user DHCP range should include the DHCPv4 Raw Option "allow known-clients;"
This will have to be added for each DHCP range, as it's not an inheritable setting.

A registration network DHCP range for unknown clients should include the DHCPv4 Raw option "deny known-clients;"
This will have to be added for each DHCP range, as it's not an inheritable setting.

A restricted/quarantine network DHCP range for blacklisted clients should include the DHCPv4 Service "Deny Unknown MAC Address".
This should be set for each restricted /16, and is inheritable, so you shouldn't have to add that to a given DHCP range.

Browser not supported