What's the difference between an employee coming in and connecting to the guest network, or an employee coming in and using 3G/4G on their device? If it is a corp device, the mac address filter option works. But what if it is their own personal device?
One thing I have done on a guest network is block access to the corporate email server (and all other internal access). This way employees trying to connect wont be able to get email. Also, as a fun side effect, as the mobile device keeps trying to connect, it kills the battery in an hour or two. :smileywink: