Can I stop one device getting on without revoking its certificate?

Yes — suspend it. Open the device or the person and use Suspend, top right. Every certificate they hold is refused at the network until you press Resume, and nothing is revoked, so there is nothing to re-issue and nothing to re-enrol afterwards.

Suspending is for a laptop that has gone missing for the afternoon or a contractor between visits. Revoking is for a device that is not coming back.