Well, for one it would stop employees accidentally connecting to the 'public' wifi and generating support calls when applications which relied on being on the secure/internal network failed to work. Or from devices automatically switching over to the public wifi when they had connection issues with the secured network.

Anyone clever enough to spoof their MAC address is clever enough to not generate a support call in these cases.