You *can* do this with Airwave but you have to make sure that all controllers in the Group share a similar config because once you move to manage mode in the Group, it will use one of the controller's configs as a config template to then sync to all other controllers in the same group. You can use overrides for the 20 controllers you wish to add the blacklist to.
Another thought...do you have Clearpass? If not you really should consider it :-). In there, we can write both the blacklisted clients and a policy to say if an auth comes in from X device group (20 controllers) AND the client Mac/user ID/device is part of the blacklist, then deny access or even redirect to a captive portal explaining what happened. See below example. We can write this blacklist based on a simple list or using more flexible regular expressions. We can also write the blacklist on other context variables like device types and usernames/AD groups.
Hope this helps!
