Setting up restrictions on router ports with network security policy

Okay so here is my scenario. I need to connect a maximum of 2 hosts dynamically to each switch interface. And then if the policy is violated the interface will be shut down. which commands can i issue on a catalyst 2960 switch to meet this policy? Shaking my head over this. thank you.