Is this possible?

I have created two policies, default and kids, and want to apply the kids one to their ipads.

Can I apply a WCF to a MAC address or IP address?

I have the default one set as default in firewall settings and that works fine.

Hmm.. digging around seems I can use firewall filters (maybe in conjunction with group objects?)

Am I on the right tracks?

That's correct, you can also lock MAC addresses to IPs with IP Objects and/or Bind IP to MAC.

This guide shows how you would make exceptions: http://www.draytek.co.uk/support/guides/how-to-exclude-specified-ip-addresses-from-web-content-filtering
The same concept would be applicable to having two different groups, with one filter rule applied to one set of IP objects / IP Group and another filter rule or the default rule applying a different content filter

Ah.. it works now I have added it to the default data filter - thanks for the pointer!

I had added it to a new filter.

It seems to have slowed web browsing slightly on my main machine though - as though it is determining whether to allow me to the site or not.