How do i control which devices join a network?

is it possible to have control over whether or not a router connects to a given coordinator? like to approve/decline a join request?

I don’t want to hard-code different PANs as that stops them being “portable” if i want to move them to a different coordinator or if two are available at once.

If you keep joining disabled and only enable joining when you want to add a device, that would work. Otherwise i am not sure there is a way to do what you want.