There are a number of security features that can only be implemented on layer two.
802.1X is used to authentificate hosts and to prevent unauthenticated hosts from becoming a part of your network. // As mentioned above you can also whitelist/blacklist devices based on their MAC but this is not as reliable as 802.1X because the MAC address of a device can be faked relatively easy.
VLANs can be used to switch different networks on a switch. This can be used to segment a network wich can increase the security when done correctly. VLANs can also be used in combination with 802.1X to isolate hosts when they violate a policy you want to enforce.
Port Security can be used to limit the devices that can be attached to a single port. This prevents the flooding of the CAM table of switches. This would otherwise cause the switch to downgrade to a HUB or a DoS.
Also Port Security can be used to prevent other attacks that operate on a higher layer but can only be prevented when you are able to include a lower layer. For example limiting DHCP to a specific physical port.
Spanning Tree is used to prevent networking loops. Loops are mostly created by accident but can also be used by intentionally to cause a DoS.
Storm Control is related to spanning tree and helps to supress traffic generated by a packet storm or even to shut down the ports that are affected.