You can certainly use access control to setup MAC address filtering. I used to do this years ago but no longer. It just is not very effective like it used to be.
If someone is going to stand on your sidewalk, or sit in a parked car in front of your house, odds are they will be noticed. And, unless you give it away, or use your dog's name, what are the odds a stranger is going to know your passphrase? And if you use a strong passphrase (I recommend at least 12 characters, upper and lower case letters, numerals and special characters), what are the odds they are going to guess it, or even crack it?
Plus - and this is the main reason I stopped using MAC address filtering, it is simple to "spoof" a MAC address. In fact, it is so simple, many modems require a specific MAC address. For this reason. most routers even provide the option to change the "apparent" MAC address of the router so the modem will accept data from it!
Yes, if you live in an apartment complex, someone in an adjacent apartment will be able to see your network. This is why you don't use your dog or kid's name for your passphrase.
I used to disable SSID broadcasting too. It was never an effective security measure anyway. And some wireless devices need to see it when setting up initial access. So I just recommend naming the SSID to something that does NOT identify you personally. That is, don't use a family name, street number, birthday, etc. Any nosy whizkid will still be able to see your network, they just won't know it is yours.
Of course if you live out in the boonies and are the only house around, then likely your wireless network will be the only one that shows up anyway.
Now what you can easily do is tell the router to limit the number of connections to a specific range of IP addresses and/or specific IP addresses. My Nighthawk does this on the LAN Setup page under "Use Router as DHCP Server". There I can assign the starting IP and ending IP. So, for example, if I say the starting is 192.168.1.41 and the ending is 192.168.1.50, then the router will only let a maximum of 10 devices connect at once and it will only connect devices using one of those IP addresses.
If you do this, remember that smart TVs, streaming devices, tablets, your smart phones, smart thermostats, security cameras, and lightbulbs may need to be included in that count too.
I also disable (don't enable) the Guest Network.
Last, every router I have used lets you see the attached devices (Ethernet and wireless). Periodically check this and verify only devices you have authorized are attached.
Disabling UPnP may cause major headaches when trying to connect some devices. Many leave it enable until all their connected devices (including networked printer and network storage devices) are working properly, then they disable UPnP again. Many just leave it enable with no ill effects.
If leave it enabled, make sure your connected computers are fully updated and secured with a decent and updated security solution and you avoid being "click-happy" on unsolicited link - the EXACT SAME advice should you disable UPnP.