Yes, we can block users connecting to wireless using their MAC address. You should configure L2 MAC ACL and map it to the respective WLAN.
Please go through the user guide(for ZD) or Administration guide (For SZ/vSZ) for configuration details.
Thanks for reaching out to us. We do not have the feature of directly blocking a user from joining the network based on the MAC address or kicking out a user that is already connected. We have this in our backlog.
There are a few related features that might help.
Use case 1: Do not allow a device MAC address to join
Solution: Use a Dynamic PSK (DPSK) network and do not provide a DPSK for the MAC in question.
Use case 2: Allow or block traffic from a user based on L3/L4 parameters (source ip/subnet, src port, dest ip/subnet, dest port)
Solution: Setup traffic policy from advanced network settings in the final step of network creation. This feature will be available shortly (~ 5-7 days)