This is a fairly dangerous thing to do. With Exchange 2010 you could do this quite easily. Simply create a group of "staff" and a group of "students" then on every student set the "Accept messages from only senders in the following list: "staff".
I know you're running 2003, but for the sake of anyone who may google this and be running 2010, the command would go something like follows:
Get-DistributionGroupMember "Students" | Set-Mailbox -AcceptMessagesOnlyFromSendersOrMembers "Staff" -RequireSenderAuthenticationEnabled $true
This gets all users in the "Students" distribution list, then sets to accept only from members of the "staff" distribution list (NB: will also stop them receiving from outside addresses).