> The school eventually figured this out. It's not clear how they avoid the situation however; do you tell teachers never to grant exceptions on student-owned devices?

Make it so the firewall exception process on student devices gives a 6 digit code which the instructor enters into a staff-only interface on the instructor's device, so that the process always requires input on both a student and an instructor's computer.