Ports that are always open? How does softwares like bittorrent manage to communicate even without port forwarding

You're right, it really is a social problem that needs to be addressed by management. If certain people are impacting the network to the point that it's causing problems for others, then they need to be dealt with and explained what the consequences will be if they keep it up. Reprogramming the MAC addresses on their NICs? If they have no legitimate need to be doing that then you might consider locking down your wifi router and network switches to only accept connections from certain MAC addresses. If they change it, they can't get on the network, and suddenly MAC address filtering/limiting becomes a possibility at the border router.

Traffic shaping for non-standard ports can also be employed to reduce the amount of available bandwidth for all ports except the standard http, ftp, smtp, etc. Turning down the amount of bandwidth available for non-standard applications makes them a lot less desirable.

Another option at your border router/firewall is to only allow certain ports for outbound traffic, limited to standard ports. This may or may not be practical given your environment.

You need nat traversal (nat-t) or nat hole punching. This is a partial solution, as many nat gateways will not allow that. This means you'll need servers with public IPs to pass the traffic between restricted nat clients as part of your solution.