You need this:
http://ranum.com/security/computer_security/papers/a1-firewall/index.htmlIn other words, cut the cord on the offender.
You can't really deny them access, you could setup a reservation for the offending machine and give them an address that's blocked from getting to the Internet.