How mitigate mac spoofing in mab

Hi! i have a problem with this vulnerability, i need mitigate it. I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. For us is the same mitigate the problem on the radius or the swicht config. Do you guys know any idea? Best regards, Say hi for your sisters!