Keep in mind that even if you somehow lock down the router and or it's LAN ports, what will stop the "pesky guest" from simply going to one of the wired LAN client devices and removing the Ethernet plug from it and plugging it into their device? While one can use "RJ-45 jack locks" or "RJ-45 port locks" available from places like Amazon, or that can be jury rigged, to try and prevent a LAN cable from being plugged in, or lock the room the router is in, or use a security cabinet or similar to prevent access to the router; in the end the "pesky guest" is the underlying problem.I see. Hmm. Food for thought on the guest, especially if it’s a relative. But yes, all good suggestions…
One should really deal with the "pesky guest" first if you haven't already. If that "pesky guest" continues to ignore your requests they not plug into your equipment, they should be banned from the location. Even if it's a relative. If they are ignoring your request on this, what else are they ignoring or doing in your home or location? They have shown themselves they cannot and should not be trusted.
