If all of your Apple devices are managed - change to using certificate-based authentication. Another painful option - change the WiFi firewall rules to default "block all". Then create a group policy called "Authorised", "Teacher", "printer", etc and manually apply the group policy to devices that are allowed. In this group policy, create a firewall override to allow access again. Similar to the above, but using VLANs. You could make the default VLAN one that doesn't work. Then if it is a teacher's device, have group policy put the teachers into a teacher VLAN. If it is a "school" device drop them into the "school" vlan. You can use a single SSID for everyone using this scenario.
... View more