Providing access to wireless users

Hi

I am using sophos xg v18 utm

We have multiple access points in our network. We have applied WPA-psk security on the same.The problem is that the key gets leak to all employees very easily and they connect their personal devices snd use internet through firewall.

We want that only specific users be connected to wireless APs. Mac filtering seems unlikable.

Please suggest best practices