I have Peplink Balance and Switches, is there a way to prevent a user on a lan port from adding their own switch or router to have multiple devices on the lan port?
You use use mac filtering firewall rules.
However that may not prevent someone from cloning the mac.
Routers present different TTL (Time to Live) values in TCP/IP packets when routers are used since the TTL value comes from the devices behind the router, not the router (ok, some routers, including some Peplinks, can override this). So if your switches are sophisticated managed switches, they may have TTL (Time to Live) algorithms to detect when different TTL values are used on a port and will then disable the port.