1.) What activity are you trying to allow?
General internet access for a small group of users from a larger local network: web, ftp, mail, etc.

2.) What activity are you trying to prevent?
Deny internet access for all other local users.

3.) What is your concern?
A denied user can change his mac address to aa:aa:aa:aa:aa:aa and ip address to x.x.x.x for example and become a valid internet user.