If you can't trust your guests, then don't let them use your network.

You can attempt to block and filter things, but there will always be a way for something malicious to bypass it.