A security engineer is hardening a corporate LAN where contractors and employees connect their laptops to the same physical switch ports in shared workspaces. The engineer must ensure that only devices meeting corporate posture requirements (updated antivirus, current patches, corporate certificate) are permitted onto the internal VLAN, while non-compliant or unknown devices are placed in a restricted remediation VLAN. Which network control best meets this requirement?