In order to permanently blacklist a client (across controller reboots), you will need AOS 6.2
You can blacklist the client using the following command:
stm add-blacklist-client <mac address>
Once you are on AOS 6.2+, you can run the following command to change the blacklist timer to permanent:
(config) #ap ap-blacklist-time 0