I was thinking of your hotspot. If you were to issue them a cert, then they should be able to authenticate with said cert and 802.1x. Assuming your WAP can support it. We have a policy in place that only Cisco Airo can be used for that specific reason.