@qaiserwali 

The only solution i can suggest is change your ssid and password  as once this is changed devices should disconnect then you can input the new password on your devices. 

This in theory should kick everyone off who is attached to your network/wifi. 

Then you can implement rules to people who you allow onto your wifi not to give your wifi password out otherwise you'll ban them permanently. 

Plus if they want to add say a new device they have to come to you first asking for permission otherwise you'll do the same again but never give out the password again for anyone. 

Does your router/AP support guest wifi? 

As you can setup a guest wifi for others to connect to and this should help keep your network safer plus if this person gets your guest wifi password and joins you can just shut your guest wifi off whilst still have wifi for yourself. 

Plus if others need your guest wifi and you shut it off then others will be annoyed that there's no wifi they need and I will tell them until my wifi  password stops being given out to who ever it is you don't want sharing to without your permission you won't turn it back on and let them deal with with the person keep giving it out. 

You'll soon find out the person handing out your password and you can permanently ban that person by not giving them the password at all. 

  @qaiserwali 

Hi,

It's either black list or white list, not both at the same time.

There is no ultimate solution for the problem you are facing.
However, if your room mates are not overly technically skilled people, then you should go with the white list. 
For this to work you need to tell the persons who you legitimately want to connect to your Wi-Fi network to first switch off the MAC randomization feature on their devices and then have them connect to your Wi-Fi network. 
Then you add the MAC addresses belonging to those devices to your white list.

Of course, if the room mates who you don't want to connect to your Wi-Fi network happen to be technical experts, then they might find a way to obtain a legitimate MAC address from one of the legitimate devices and clone it to their own device.