Don't really understand, but if the machines where part of an organizations domain using active directory, you can push out a group policy to have the machines only connect to a single ssid if you want. You also can set the order of preference since you still want the user to be able to add their own wireless profile for home and hotspots. You secure wireless using various methods available and what is supported by your devices. It's the client devices at the end that will choose what ssid they will connect to and that is where you have to make the decision onto your policy. If users are allowed to bring in their own devices, you have no control. Then it becomes user training on what and how they should connect to the wireless.

Sent from Cisco Technical Support iPhone App