Your comment makes things seem more clear.
802.1X or IPSEC, deployed using certificates on each client computer to permit client device authentication, is going to give you the secure environment that you want. Nothing can be done to easily prevent unauthorized devices from being attached to the network medium (with spoofed IP or MAC addresses, as necessary) if you're not actually authenticating the client devices.
If the users can physically manipulate the client devicess (i.e. attempt to pry the certificate out of the device) then even device authentication is no good.
Assuming, though, that you can store the device certificate in a reasonably tamper-proof location that cannot be practically accessed you can create a very secure situation, with respect to unauthorized devices being attached to the network medium and used to access servers, using either 802.1X or IPSEC.