With Instant this would need to be accomplished by a combination of client isolation (deny inter user bridging and local routing) and DHCP snooping on the upstream switch.
------------------------------
Carson Hulcher, ACEX#110
------------------------------