I added a captive portal to Wireguard and in that I added to "Allowed MAC addresses" the MAC addresses of the mobiles being allowed to connect.