That depends on your environment. The first step is to deploy port-security. If only one MAC-address is allowed per port, then at least no wireless clients can connect to your network through an AP. But if someone really connects a wireless router, then the switch will only see one MAC address and it won't help any more. In this scenario, only allowing known MAC addresses to connect to your network could be the solution. But before doing that you better plan for deploying ISE.
