I've seen that, but it's a losing battle. People will unplug company IP phones and plug in their thing instead. Or use any number of other user-space networking, wifi sharing, etc, tools. Eventually you end up having to whitelist every legit MAC addr. Even that isn't safe, since I can spoof the MAC of anything I just unplugged, and many of them have helpful labels on them. So now you have to deploy certificates, and exceptions for things that don't support them. I imagine bad actors recognize which sorts of devices don't support certificates, so they would know what to unplug and spoof. Ugh.
Just treat the office network as untrusted and be done with it. That's how every "WFH" worker is coming into your network anyway.