Lock out MAC spoofing (private address) on Wi-Fi network

I want to put content and time limits on my child's iPhone. I am doing it through my router by firewall rules for the iPhone's MAC address (completely within my domain and control). I know how to turn off Private Address on a Wi-Fi network in iOS. The problem is it creates an error message for the network "Privacy Warning" prompting the iPhone user to turn it back on for that network. How can I lockout Private Address on a particular phone for a particular network, i.e. under passcode? Alternatively, is there a predictable MAC address range for iOS private addresses that I could just block all iOS spoofed address on the Wi-Fi network?