How do i control which devices join a network?

is it possible to have control over whether or not a router connects to a given coordinator? like to approve/decline a join request?

I don’t want to hard-code different PANs as that stops them being “portable” if i want to move them to a different coordinator or if two are available at once.

In the 802.15.4 protocol, you can control this using the Channel and PAN ID functions. That is it.