You could look into 802.1X with certificates. This still requires a certificate to be downloaded to the client, but there are several automated ways of doing this.
You will need a certificate authority, and a RADIUS server (such as ACS). There's loads of documentation on CCO on how to configure this.
HTH