Enhance security in big cisco switched network

Hi, What is your experience with enhance security in a big network in physically issue.

I mean to protect network from undesirable laptops or user's computers from home etc.

I consider apply something like 802.1x or VMPS. I have DHCP as well in each VLAN.

There is many disadvantage in each proposal and I don't know what will be the best solution.

{ example: in VMPS very, very big list of MAC addresses, similar problem to block MACs in DHCP ) in 802.1x - someone can write his password in his laptop ( in MD-chalange ver. ) }

Has anyone implemented something like that in your netowrk ?

Any suggestions ?

Thanks in advance.

Regards, grzybek