A network technician notices that employees are plugging unauthorized switches and personal devices into wall jacks in a conference room. Management wants each access port to allow only the first device that connects and to automatically retain that device's MAC address in the running configuration. Which switch feature and setting best accomplishes this goal?