I am running Sophos UTM 9 and I would like to block internet access based on a schedule (only allow access during lunch, non business hours, etc) by MAC address.
Yes, use 'DHCP Settings' in a Host definition for each device and create at least one 'Web Filtering Profile'. Use 'Time Events' in 'Filter Assignments' in 'Web Filtering Profiles'.
You have to learn a lot, but the good news is that it is easy to do once you know the basics.