Generally, there is no way to prevent a user changing his node's MAC address. You're left with detecting MAC spoofing.
On wired networks you may want to enforce strict MAC-port association - you only accept a given MAC on its assigned port and on a given port you only accepted the assigned MAC. I'll also want to watch link states very closely - after a link down/up event occured you can't trust the MAC on that link any more, the node may have been replaced with a spoofing node.
A common approach to authenticate links before admitting them to the network is 802.1X port authentication. However, 802.1X has many attack vectors and there are numerous extensions for preventing that - or rather, make it harder.
On wireless networks you use 802.1X authentication by default, so you know who's gaining access. The MAC address is pretty much useless for security here since anyone can use any address. Of course, you can monitor a node's geographic location through the radio parameters, but this isn't possible with a mobile node.
Fingerprinting a node (through its OS/stack) helps to raise the bar but isn't 100% reliable - an attacker could spoof that as well.
What you're left with - depending on the security level you really require - is a cryptographic approach with a PKI or centrally managed keys.