I used to do something similar with hook scripts from DNSMasq and sending notifications to my phone. The next step was to allow me to click a button in the notification and kick that device from the network, but I never did get around to figuring out how to do that; I expect it wouldn't be done in DNSMasq, but I don't know which service _is_ responsible for kicking/blocking devices (by MAC presumably)?