Thanks for the suggestions, I got home and suddenly realised that Dansguardian can do this for me, it is a bit of a kludge and I haven't tested it yet but it should work.
Basically you set the default filter list group to be a blanket block (so no internet access) and have it so that it displays a php page on the proxy (instead of the html template) that displays the policy with an agree link that when clicked the script adds that user name to the normal student access filter group and gets dansguardian to reload the groups, then redirects the user to the requested page. Then just have a cron job that runs daily/weekly/whenever that clears the filter group list (so everyone goes into the default filter group).