While not versed in networking, I was able to find this manpage on arp(8) for reference:
-s hostname ether_addr
Create an ARP entry for the host called hostname with the Ethernet address ether_addr. The Ethernet address is given as six hex bytes separated by colons. The entry will be permanent unless the word temp is given in the command. If the word pub is given, the entry will be "published"; i.e., this system will act as an ARP server, responding to requests for hostname even though the host address is not its own. In this case the ether_addr can be given as auto in which case the interfaces on this host will be examined, and if one of them is found to occupy the same subnet, its Ethernet address will be used. If the only keyword is also specified, this will create a "published (proxy only)" entry. This type of entry is created automatically if arp detects that a routing table entry for hostname already exists.
If the reject keyword is specified the entry will be marked so that traffic to the host will be discarded and the sender will be notified the host is unreachable. The blackhole keyword is similar in that traffic is discarded but the sender is not notified. These can be used to block external traffic to a host without using a firewall.