The issues related to web access by students, teachers and administrative staff can be divided in two types to be considered while designing school Local Area Network

1. Logistic of spaces and of physical access to work stations.
2. Rules defining web access by the single user

Logistic of spaces

Physical access to work stations can be managed to separate the ones reserved to school staff (i. e. teachers, administrative staff) from the ones reserved to students.

Generally speaking, it's a good rule to separate web access points into different "areas" each with different policies and safety rules

Restricted areas can be necessary if the net connected devices are essential part of net operating (i. e. server, switch, router, firewall, etc.).

Access rules

Access management (meaning a procedure to regulate physical access to work stations) can be ruled in different ways

Normally, if a LAN connects the whole school, access is limited to one or more accounts; in a practical way an account (username/password) to access school work station is allocated to every teacher/administrative employee.

Users without account cannot have access to computers or have an access limited to very few functions.

Accounts can be customized to allow single users to use clearly defined features: i.e. personal file, web access, system configuration, printer, etc..

These policies can limit access by a user to a specified work station

Generally, users are divided in groups (teachers, students, employees, etc.) and different access rules are stated for every group; also access rules are different if a work station is located in a restricted area.