don't think you can do with open or PSK (exclusion will at WLC level) but if you are using 802.1X, then you can try this : uniquely identity the AP using called station ID (base radio mac + WLAN ID value) or custom NAD-ID then you obviously need MAC of the client, then you can build a policy on your radius with condition containing endpoint MAC and Called station ID and deny as authorization result.
-hope this helps-
