How to completely block specific Wi-Fi SSID on macOS? I'm looking for a way to totally blacklist a Wi-Fi network (by SSID) in macOS. 

And no, I promise you that I really (truly!) do not need to just have the computer "forget it" by removing it from the network list. I need to completely and  totally prevent the computer from connecting to a certain network entirely. 

It's super, crazy easy on Windows. Is there any way to do this on a Mac?
There's no blacklist function (that I know of) but there are a couple of simple workarounds
Restrict to Admins Only
Your first option would be to set up networking and restrict it so only Admins can join networks (Network Settings &gt;&gt; WiFi Adapter &gt;&gt; Advanced)

The caveat here is that the user can no longer be an admin.
Progmatically remove network
Your second option is to have a terminal command run periodically:
networksetup -removepreferredwirelessnetwork en1 SSID

If the SSID doesn't exist, it will just error out without any issues.  If it does exist, it will remove it from the preferred (saved) network.
You could put this is a simple bash script
#!/bin/bash

SSID=MyBannedSSID

net=$(networksetup -listpreferredwirelessnetworks en1 | grep ${SSID} | cut -f2)
ap=$(networksetup -getairportnetwork en1 | cut -d &quot;:&quot; -f 2 | cut -c 2-)

# Remove Network if exists in saved networks
if [ &quot;$net&quot; = &quot;$SSID&quot; ]
  then networksetup -removepreferredwirelessnetwork en1 ${SSID}
  sleep 5

else echo &quot;No Network&quot;
fi

#Power cycle wireless adapter if connected to banned network
if [ &quot;$ap&quot; = &quot;$SSID&quot; ]
  then  networksetup -setairportpower en1 off
        networksetup -setairportpower en1 on
fi

then use cron or launchd (preferred) to run it periodically.  The caveat is that while they may join the network, it will eventually (per your schedule) delete it.
You have to run this as root (meaning put in /Library/LaunchDaemons if using launchd) otherwise it will ask you for a password every time.
What the script is doing

Checks to see if banned SSID is saved
Removes the saved network if it exists
Power cycles the airport card if it's attached to the banned SSID