Yeah that's not really an option today. One alternative would be to have separate networks for egress, and add the clients to those networks.