Quote:

Im afraid a proxy isnt the solution



Don't be too quick to disregard it.

The simple solution is to (ask) for the the external proxy that you do not manage to only accept connections from a single IP address. Assign this IP address to an internal proxy server which is under your control.

You now control which users / machines can access the Internet. Either provide the teachers with access to the proxy configuration to allow them to turn rule sets on and off, or configure time-of-day rules to do it automatically if the time-table is sufficiently structured.