I think you're falling into the trap of looking for a technical solution to a managerial problem.
This is a case of users circumventing security. Try talking to them; why would they want that hotspot? Does the official Wi-Fi network have shortcomings that they're trying to work around?
As long as this is not addressed they will find ways to work around what you're trying to fix.
Why? Because this is not really something you can fix with a firewall.
These only look at the physical and logical addresses, which aren't much use here.
If you don't know who is doing it, you could try foxhunting them with airodump-ng, or see if your Wi-Fi solution supports rogue AP detection.