methods to block users from wan other than fixed ip address

is it possible?

can i allow/block a computer from wan based on something else other than public fixed ip?

from what i know, mac is impossible because it's layer2

but is there another way?

thank you