Let's consider this scenario:

S2750 with V200R006 or later software release configured with 802.1x authentication on access ports. We have 3 VLANs,

VLAN A it's use for RADIUS LDAP communication.

VLAN B it's the network VLAN on which user gets after it pass dot1x authentication successfully.

VLAN C it's the restrict VLAN on which user gets after dot1x authentication fails.

The requirement:

After user fails authentication and gets into restrict VLAN, switch should not allow the user to try authentication again even if it will use the correct credentials to perform authentication.

Configuration example:

>> interface Ethernet0/0/10
>>     port link-type hybrid
>>     port hybrid pvid vlan A
>>     port hybrid untagged vlan A B C
>>     dot1x enable
>>     dot1x max-user 2
>>     authentication restrict-vlan C
>>     dot1x reauthenticate
>>     dot1x authentication-method eap