Filter out ARP query from given ether:ip
You could use a static ARP entry to solve the problem. This is done using "arp -s" as you write in your question. The second association is not a problem as the static entry will take precedence.

Alternatively you could block the MAC address of the spoofer. For example you could use the "ifconfig bridge" command to create a bridge over which you tunnel all packets from the evil MAC-address. When configuring the bridge, set that it tags the packets.

Then you can use the pf packet filter to examine all the tagged packets and possible reject them.