A network administrator wants an access switch port to dynamically learn the MAC address of the currently connected workstation, add it to the running configuration so it survives a reboot after the config is saved, and then reject any other device. Which command achieves this dynamic-yet-persistent behavior?