Is it possible to separate a range of ips in the range for a given router?

[jimp]

Something else to consider if your switches and APs support it might be 802.11x / WAP2 Enterprise using RADIUS.

You could have the clients authenticate before they get an address at all, and the RADIUS server would tell the switches/APs/etc where to put the clients on the network (e.g. a specific SSID, VLAN, or address assignment). That separates the user identification from other parts of the process which are more prone to error.

That may be its own special kind of management headache and end user headache, however. It's much more viable for wireless than wired clients.

At least that way you would know for certain that the clients you want to use a specific network are the correct clients without having to guess by MAC address.