We activate the iPads on an unfiltered connection, but once the profiles come down we force the students to use the filtered connection.
This is how we have been coping so far, but it means that you cannot set up shared iPads, because they cannot log into their Apple IDs on the login screen. & sometimes the iPad bugs the students to resign into iCloud on thier iPads, but they can't while at school.