matt,
we're a k12 district as well, so i feel your situation
every step of the way. well pending on your network
schema, you can have your teachers in different groups
than your students. AD GPOs can be distributed to certain
OU containers, so what we have is our teachers in a
subcontainer OU in their school's OU and something similar
for the students, so now you can distribute policies
strictly for teachers and strictly for students. let me
know if this helped. not too sure on what you want to
implement and what your network topology is. take care.
cheers!
~adrian