SSL VPN and Reverse Proxy have rapidly replaced traditional IPSec VPN solutions in the corporate sector.
Many LEA's use Aventail and Sonicwall appliances for remote access for council staff to internal resources.
Reverse Proxy or Terminal Services Gateways are to be standard in Longhorn server, providing SSL web based access to RDP, thus allowing students to log in and use your classroom PC's from home in exactly the same way as they do when in class.
The difference is they will be using your existing licenses and software.
Applications can be delivered directly with a 70k msi over the web.
This feature already exists is Microsofts Small Business Server as Remote Web Workspace.
The code was scheduled for release as part of 2003 R2 but was pulled by the Longhorn Team from R2 at the last minute.
There are some limitations however with SSL appliances such as the NG 312 and the Sonicwall that need to be fully understood before you buy into that solution.
Any VPN will effectively "glue" the remote pc to your LAN and if it's riddled with all sorts, you will be likely to "catch" something.
If you use IE at home and use an SSL device to proxy for you on your school lan the headers are often mis understood as your browser will ask for an intranet page in IE format the request will be made by the appliance in Mozilla and pass the proxied request back to your IE in a foreign format.
They are however very cheap, simple to install and easy to maintain.
The SMT can be working from home they same day and that will earn you brownie points.
Don't spend too much time or money on this project because TS Gateway on Longhorn "Rocks" and you will undoubtedly will forsake all others for this way into your school networks.
Just Google for TS Gateway and see what comes up.