Endpoint control can be achieved by integrating with IPAM.

Configuration

# put the device in blackhole
create fdbentry "mac_addr" vlan "vlan_name" blackhole

# put the device out blackhole
delete fdbentry "mac_addr" vlan "vlan_name" 

Check

show fdb blackhole