Can ACL filter MAC address?

I have a friend who wants to know if he could use ACL to filter users MAC address instead of IP address. His problem is that some of the employees in his office knows the administrator IP address and they use this address to gain access to the internet after office hours. He is wondering if the ACL can be configured on a Cisco PIX firewall router.

I only use ACL to filter normal IP address as well as protocols but never to filter MAC address, so i could not help him with this problem.

Can anyone suggest better method to do this? Would appreciate any help. thanks