802.1x ? (But I think that needs an external RADIUS).

To be clear...you want to whitelist the MAC addresses of the APs, not the wireless clients which connect to them, right?

I thought you meant the APs, but then you said:

I was hoping there was a way of ensuring that only authorised machines can access the internet.

.