lets say, hypothetically, that this makes sense.
if these machines are owned by the school, and intended only for this use, I would say they should get machines with no wifi hardware (otherwise shut it off in the bios); cut the wire for the ethernet port (or even fill it with cement) - some BIOSes will let you shut it off at that level too. Basically shut off the hardware, and protect the BIOS with a STRONG, UNIQUE system password. Intel's vPro may help here.