You can use your Windows Firewall to control traffic to authenticated and non-authenticated machines, domain machines, etc., in conjunction with IPsec tunnels between your authenticated machines to encrypt the traffic so it's useless to a WiFi sniffer. This is actually a lot easier than it sounds and you can easily look up how-tos depending on what version of Windows you have and you don't even need any third-party software, unless you would prefer to use third-party VPN software. Or you can also statically assign all the IPs on your network and configure the Windows Firewall based on the scope/IPs of the machines you want to be allowed, but this is far less secure for a whole host of reasons. Obviously neither is blacklisting and it's not as good as kicking someone off the hotspot, someone can still sniff all your unencrypted traffic if they are set in promiscuous mode, but it may be the closest thing.