That needs to be something configured on the access point, to make it a hidden SSID, which means, only if you know the details of the SSID can you manually enter it in to connect to it. I don't know of anything in either Casper or in the macOS in general that would allow you to hide specific wireless SSIDs from showing up in the menu. When Wi-Fi is enabled and the user clicks on the menu, the wireless client scans the network for SSIDs it can attach to and presents them in the list. Again, I don't know of a way to block specific ones.

If making it a hidden SSID isn't an option for you, you can look at creating and deploying a LaunchDaemon that would check for network changes and run a script to see if the SSID the Mac has just connected to is "silverwings" and if so, disconnect it from that SSID.

So basically this needs to go through networking. I figured as much. I wonder why its so easy for them to hide it on Window boxes.

That's a good question. Its possible Windows has some kind of GPO or other setting that can be applied to hide specific SSIDs. I'm not that familiar with it to know for sure.

That being said, its possible I'm wrong and there is some way to hide them on a Mac, but I don't know how, if so.

Do you know what is causing them to want to go outside of production? If it's compliance you're after, we use Digital Guardian to enforce our network adherence to keep users from trying to work off our guest network. It has rule-enforcement to detect our production network, and if not detected, turns of your internet access or forces you through our VPN. It's got some other things I'm not as much a fan of, but network compliance it does ok enough.

Our designers like to go to guest network to pull fonts and pictures from sites that they shouldnt be on. Windows side is a GPO that works for them. Mac side nothing.