How can we restrict any unknown user to add router on your network?

MAC is always a problem, because MAC is a easy to clone, you can block any strange subnet from your own, after that you are secure. Because on the user side of "alien ruter" (LAN) is always diferent subnet then the one on the WAN...

You can enable MAC based access control. That's it.