The solution really depends on what your environment is, and what you're willing to put into place. There are a few solutions that come into mind, including the ones mentioned in other answers here:
- Separate VLANs for public meeting spaces, and internal workstations. The downside of this is that a smart attacker can perform a VLAN hop (depending on the implementation), and end up in your workstation VLAN.
- 802.1X, which requires you to implement a RADIUS server, and a fair bit of management on user workstations to ensure that they have the right authentication profiles and certificates to talk to your network.
- Network Access Control (or in Cisco language, Network Admission Control) which lets you authenticate users using LDAP, based on MAC address, or other mechanisms depending on your NAC implementation.
Of these three, VLAN is probably the cheapest in terms of effort on your part in configuring the environment - you don't have to do anything on user workstations, and you just have to ensure a proper segmentation of the network. 802.1x is more expensive in terms of effort and adoption, but still cheaper than a NAC solution. The NAC solution is probably going to be the most effective, and most expensive of the three, especially if you get a solution that doesn't need to deploy an agent on the workstations. It will still require some user training depending on how you implement it, but it is much harder to bypass a NAC control than it is to bypass VLAN restrictions.