But, it's probably far easier to just run a wire guard VPN server, and require every device to connect to the server to get network access. So any device physically plugging into your network would only be able to route to the wire guard server.
if it's not WLAN, you could have a VPN in the LAN and simply not route anything not from the VPN. The devices in the LAN could still communicate with each other though, and someone could share their internet and become a router. To limit that, you need a special switch. Usually that's not possible for switches, as they are Layer 2 and the things you want are Layer 3, but you're not the only one who wants that, so special switches with more capabilities are available.