Probably better to put in a separate restricted vlan. Who knows, maybe one day some piece of firmware code will kick in to start rotating MACs to lie who the device is to get a connection.