You could create a reservation for the device so it always gets a specific IP. Then you can great a SOURCE_GROUP with that. Then you can use that in an ACL. Here is a good example I ran across applying some rules to students and different ones to teachers.
ubnt@ubnt# show service webproxy listen-address 172.16.3.52 { } url-filtering { squidguard { rule 1 { local-block www.youtube.com local-block www.facebook.com source-group STUDENTS } rule 2 { local-block match.com local-block eharmony.com source-group TEACHERS } source-group STUDENTS { address 172.16.1.0/24 } source-group TEACHERS { address 172.16.10.1-172.16.10.20 } } }