A normal Web browser will send, as part of its requests to Web servers, a standard header called
User-Agent, which usually states the browser vendor, version, and type of machine and operating system on which it is currently running. You can use that to react on some device types. However, this is only for a cooperating client: a malicious user can alter at will the user-agent his browser sends.
A more thorough solution, but more expensive, is to install some device-specific secret value in each "approved" device. For instance, use a Certification Authority to issue a certificate for each device; when connecting, the server will require the client to show its certificate. This is a standard procedure in SSL. It would still be up to the server to check that the authenticated device identity is one of the "approved" identities (in a Microsoft context, Web server is IIS and can map certificates to accounts in Active Directory, which is a possibly way to implement that).
You cannot prevent a malicious device owner from extracting the certificate (with its private key) from his device, and installing it into another, non-approved device; but, at least, when you detect that such a villainy has been perpetrated, you can first block that identity server side, then revoke the offending certificate and thus recover from the consequences of that heinous act.