You can do this by going to Configuration> Open the Network Policy> Open the User Profile> Create a MAC Firewall, set all of the MAC addresses you want to block to "DENY", and have the finally rule set to any MAC> Any destination> Allow. The firewall will apply the rules in order, so if the MAC address matches any you've set to deny, the AP will deny them. If the MAC doesn't match any on the list, it will then be allowed to connect. You want to keep the default action for the firewall in general to "PERMIT" as well so as not to block all traffic.
I will say that we recommend using a content filter or firewall for larger MAC filter lists. The APs are not designed to be firewalls; they have some features for small, targeted firewall applications but for larger operations you'd want to use a firewall or content filter.
