How to deny a workstation access to network if not on domain

I have a wise-crack that keeps on asigning static ip and installing software on workstation. How can I block this workstation from accessing any other workstation unless he is joined to the domain