Prevent Network-Discovery on Infrastructure side
It's possible to block Bonjour traffic by configuring pf to disallow:


MAC addresses:
01:00:5E:00:00:FB – IPv4
33:33:00:00:00:FB – IPv6
IP addresses:
224.0.0.251 – multicast IPv4 address
FF02::FB – multicast IPv6 address
UDP port 5353


However, this will also impact your own regular and "desirable" hosts.

One possibility is to configure a VLAN and set it up as default network for your clients. A VLAN - properly set up - spans its own broadcast domain which can't be bypassed or bridged by Bonjour traffic. 

You need appropriate devices in your network environment to be able to create VLANs.