Yeah, it's a wordy title for an oddly specific question.
What I'm trying to do is disallow devices connected via the Windows 10 mobile hotspot, while still allowing the device that created the hotspot. Basically, I want a device (say, a laptop), to be allowed on the network, but disallow any child devices (like a phone) connected through the laptop's hotspot.
I'm currently using MAC address filtering to specify which devices are allowed, but as far as I can tell any child devices connected to an allowed device via the allowed device's mobile hotspot seem as if they're coming directly from the allowed device (i.e. to the network it looks like only the allowed device is connected).
I haven't tested how USB tethering to allowed devices or a Bluetooth PAN work in terms of bypassing the MAC address filtering, but I have a feeling they'd bypass it as well (although I'm less worried about my users finding out about this feature).
...I'm using a TP-Link Archer C9 with the 1st party firmware (although I'm willing to flash it).