I took a look at what a RADIUS server would do for me. Basically it can provide the MAC address to m0n0 as the UserID. That's it... no two factor... no three way match. Ja, I know... pretty much what I was looking for in my first post but managing the accounts in RADIUS is a big PITA.

I decided to go with individual named accounts and passwords that expire after a short time. I disabled concurrency so that should curb sharing. For added security, I will also do reserved IPs and created a rule in the firewall for that range of IPs.