The Aironet products are layer 2 devices meaning it will not matter what subnet the client is in it will still pass the traffic.
You will need to add this level of control via a router.
The simplest way would be a ACL on the ethernet interface
access-list 1 permit x.x.x.x y.y.y.y Where x.x.x.x is the starting IP of you valid address range and y.y.y.y is the reverse subnet mask
apply this inbound on the ethernet interface that goes to the AP
The rouge client will still be able to get up to the router but no further if you want to stop him you will need a router on his end.