Here is a solution to create an unique identifier that is based on the device's MAC address (but is not easy to guess and is not the MAC address itself):
/** Returns a hashed uint64_t */
uint64_t getHashedInt64(uint64_t u)
{
    uint64_t v = u * 3935559000370003845 + 2691343689449507681;
    v ^= v >> 21;
    v ^= v << 37;
    v ^= v >> 4;
    v *= 4768777513237032717;
    v ^= v << 20;
    v ^= v >> 41;
    v ^= v << 5;
    return v;
}
/** Return a device unique identifier based on device's mac address, eg. 6C4080B51A5D3659 */
String getUniqueId()
{
    uint64_t mac = ESP.getEfuseMac();
    uint64_t hash = getHashedInt64(mac);
    uint32_t msb = hash >> 32;
    uint32_t lsb = hash & 0xFFFFFFFF;
    char unique_id[20];
    sprintf(unique_id, "%08X%08X", msb, lsb);
    return String(unique_id);
}
Calling:
getUniqueId() returns something like 6C4080B51A5D3659