By whitelisting MAC addresses. If you are doing any sort of MAC address based filtering, you need to only allow known MAC addresses to connect to begin with.
They don't even need a separate adapter - changing your MAC address is easy to do in software, and some cell phones now randomize their MAC automatically when connecting to wifi to help anonymize them.
Even then, if an attacker can see traffic on the network, they could simply forge a MAC address from an already authorized machine. It provides some security, but not absolute security - there are a lot of ways a smart attacker can work around MAC address restrictions.
If you want to ensure even clever people can't bypass those restrictions, they need to be enforced by something like 802.1x, which validates the machine being connected either with a username and password or SSL certificate, before allowing them to connect to the rest of the network.
If you just want to make the restrictions a bit harder to get around, you can do that by restricting EVERYTHING that connects to the network, then whitelisting the devices you don't want to be blocked. There is still some potential there for spoofing the mac address of a whitelisted device, but it will at least be harder than just changing your MAC address to any random value.