Is there a need to use public OUI numeration for "private" Ethernet ports?
As Marcus suggested, this is where the locally administered MAC addresses come handy. Here is the structure of a MAC address (taken from Wikipedia):



So, set b0 of the first byte to 0 (unicast) and b1 of the first byte to 1, and then you're free to set the other bits as you wish.

However, this requires that you can ensure the following thing: this port should never be connected to a network where there might potentially be other nodes with locally administered MAC addresses.

But equipments with locally administered MAC addresses are not supposed to be found on the market. If the only equipment that can potentially be connected to this port is a regular laptop, or even a whole newtork containing only regular switches/routers and computers, there is no such risk.

Now, there are two strategies: either you decide on a single MAC address and assign it to all your devices (they will all have the same address), or you define a scheme with a fixed and a variable part (the variable part can be taken from the serial number of the device if there is one available somewhere), so that each device has a unique (locally administered) MAC.

The single MAC address scheme is only possible is you can ensure that:


There will never be two such devices on the same subnet at the same time. This is easy to guarantee if the service laptop is always directly connected to the device (not through a network with potentially multiple nodes).
You don't disconnect one of your devices from the network and plug another one before the ARP cache of the service laptop (or any other equipment that needs to talk to your device) has expired. On typical linux/windows computers, the ARP cache expires after a few minutes. On other equipments, it can be much longer.


Regarding your concern of potential MAC address filters set by the IT: this isn't likely. MAC address filters are typically set on a network equipment (wifi access point, network switch, ...), and are set so that only registered nodes can connect to the network. If this is the case, you'll have a problem anyway, because your device won't be registered whether it has a regular OUI-assigned address or a locally administered one. I have never seen a MAC address filter set on a computer station, even in totally paranoiac IT environments.

As a conclusion, I think having a locally administered address in this case likely won't lead to a problem. However, problems are more likely to arise if you assign the same address to all your devices. I'd rather use unique addresses per device if it is achievable.