You should be able to do this in System Properties on the users tab. You can create a policy here that "this criterion is NOT met if user MAC address equals xx-xx-xx-xx-xx". You will also have to specify on the individual proxy services that the default rights must also be granted, as WinGate uses the most permissive rights.