Yes , I deal with this on a daily basis in China. (don't even talk to me about WIFI.com)
It is almost impossible unless you employ AAA Radius, which has a record of all valid macs
we get round the 'contractor' problem by splitting out a contractor WIFI to a separate VLAN & SSID
Each contractor gets a separate pw.
They don't play nice, we can rate limit all contractors in a couple of min, or ban a specific one.
Rate limiting a separate SSID prevents it impacting our own users.
storing the ACL in the ZD is not always an option due to the stupidity that is "randomised macs"
on mobile devices, massive headache for management if in the ZD
Also finger printing is not reliable, win 7,8,9,10 & mobile all come as 1 print.
some android devices from China identify as apple or Android