Advanced dhcpd.conf configuration

I am trying to get dhcpd to only assign leases for clients who are requesting pxe boot and only for clients I identify by MAC address.

I can accomplish either one of these but not both at the same time.

Does anyone know how to do this or if it is even possible?

My current approach is to create classes for boot requests as follows:

class “pxe” {
match if substring (option vendor-class-identifier, 0, 9) = “PXEClient”;
class “etherboot” {
match if substring (option vendor-class-identifier, 0, 9) = “Etherboot”;

Then I have a group that identifies hosts by mac

group {
option dhcp-client-identifier “pxeboot”
host custom_001 { hardware ethernet: 00:00:00:00:00:01; }
host custom_002 { hardware ethernet: 00:00:00:00:00:02; }

In my pool section, I can say
allow members of “pxe”;
allow members of “etherboot”;
But this allows any other client issuing a boot request to obtain an address.

How do I restrict it so that only members of my previously defined group and be a member of the pxe or etherboot classes can get an address when pxe booting?

Thanks in advance.