A way to do this is to use Aruba DHCP Fingerprint: you can create a User Derivation Rule writing the DHCP-Option for specific device or OS and assign it the deny-all role. The DHCP-Fingerprint and the DHCP-Option is explained in this useful guide:
http://www.arubanetworks.com/wp-content/uploads/AOS-DHCP-FingerPrint-AppNote.pdf
The image showes you how to create a User Rule. After you have to assign this User Rule to the User derivation Rule parameter of the AAA Profile of your SSID.
[If you found my post helpful, please give kudos]