Thanks for this. Your document says "There's no way of making a meeting private, unfortunately: anyone in the Team can join if they're online at the time. We have disabled private one-to-one calls for safeguarding reasons, so you will need to make students aware of your expectations:" (my underline).
How did you prevent staff staff creating a team including just themselves and one student, and thus create a private 1:1 meeting? I can't figure a way to do this.