Maybe you could use the "Parental Control" feature in your router. Even old units have that. You simple type in the URLs to block or allow. For example, this is what it looks like on my gateway:
You can exclude computers on an individual basis. This can be a lot of work though, and highly ineffective, since you'll have tons of computers connected and also they change all the time.
An alternative would be to have a second network in which the parental control is activated for all computers and one in which it's activated for none. That way, teachers would connect to the one without restrictions and students to the restricted network. That would only be a matter of sharing the right passwords with the right people. This obviously requires no additional software or hardware, just a little bit of tinkering with the gateway's setting wizard.