It's really simple and just a matter of the following line within the subnet declaration.
deny unknown-clients;
See example below:
subnet 10.25.20.0 netmask 255.255.255.0 {
range 10.25.20.11 10.25.20.254;
deny unknown-clients;
option routers 10.25.20.10;
option domain-name-servers 208.67.222.222;
 ........