After further experimentation, I set up one of the "User Defined" groups with the following options checked:
- Under Network Configuration
- Device View configuration Access
- Network Devices
- Monitor Clients
The user can enter the MAC in the Application Search bar, make note of which port the device is plugged in, click on link to the switch, go to Configuration > SwitchPort, find the port the device is in, then disable and enable the port.
Problem is, the user can also mistakenly change VLANs, disable an uplink, change the IP on a VLAN interface, etc. And it's not as simple as we were hoping.
Any other ideas would be appreciated!