If you have a router that has a mac address filter you can only allow certain mac addresses that are allowed to access the LAN. That way you can prohibit strangers from using your lan in a simple way. If your router not only blocks access from unauthorized macs but protocols the tries to gain access you will know for sure. Depending on the router model you can apply such filters to wired or wireless lan segments.
This is only a very basic implementation but one that every half way up to date router should be able to provide. Apart from that there are other ways, but with increasing complexity.
Cigarettes are a lot like hamsters ... harmless until you put one in your mouth and light it on fire.