Yeah. Easiest solution I think is just to connect to WPA2-EAP then enable a hotspot with mac address restrictions.
update: nvm, on a second thought, mac can be spoofed as well. guess the simple solution still is just to tune the TX power to absolute minimum so that the good ol physical wall can defend the network lol.