khaled,
If there is a way that you can identify their mobiles via mac address, you can block them. If not, you should make sure that employees do not have access to the approval mechanism or that the guest network has even less privileges than the production network.