You'll want to use Cisco Port Security on the access-layer switch. It allows you to set the maximum number of MAC addresses on a certain port, as well as optionally set the specific allowed MAC addresses on that port (Though managing this can get out of hand). Once more MAC addresses are detected, or a different MAC address is swapped in, the port can be configured to shut itself down.
I'm not sure how to stop people from hooking up a NAT-capable router, as in this case, only one MAC address is exposed to the access-layer switch. Port security won't be able to help (Unless you rely on the fact that swapping out a workstation for the router will cause a MAC address change, blocking the port, but this isn't perfect as if the first device to be plugged into the switch is the router, it becomes the allowed MAC address)
More info at http://articles.techrepublic.com.com/5100-10878_11-6123047.html