Navigate to Switching > Watch > Switch ports then filter for MR (just in case you have previously tagged your ports or decide on ports manually if you have not) then choose These ports and click on on Edit, then established Port status to Disabled then click Save. Cisco ISE is queried at association time to acquire a passphrase for a devi