Deny NAT without using IPsec2

Dear All
If some one connect his Lap Top to the network and give it the same network range or get IP from DHCp he can access all domain PCs sharing and authenticate and copy all data he need.
because that i need to deny access from out domain laptop to domain PCs without using IPsec . I am using assign but it isn’t force my needs.