We have come across such cases in a factory a few months ago. The Factory Act clearly states that the employee is eligible for payment as soon as he enters the factory and until he leaves, unless you have clear proof that the person was not working. It is presumed that he was working as long as he was inside the factory.
Steps to Address Early Punch-In Issues
The first step you need to take is to inform the security not to allow someone into the factory and not let him punch in until the shift start time (generally, companies allow a 15-minute early sign-in for shift change and overlap). Otherwise, this problem will continue.
Involvement of the IR Team
For the rest, you need to involve the IR team and decide on it. If he was working, then he deserves overtime even if he was not authorized, since that is your internal problem and he cannot be penalized for it.
Handling Rule Violations
On the other hand, if he did violate the rules, then you can initiate a domestic inquiry and take the proper steps on it.
Remember that the impact of either action can go far beyond payment to a single employee. Therefore, the IR aspect must be carefully studied.