YES, you've hamstrung yourself with the REQUIREMENT of keeping WEP & not using MAC address limitations.
The ONLY other option would be if you have a Web Filter device or software on the network which monitors all Internet traffic/packets.
Depending on the make or model of Filter you may be able to block certain browsers (such as Safari or more specifically look at the specific version of Safari that the iPhone uses)
This will not however prevent the users from getting onto the network and accessing your LAN... just Internet use.