Hi James,
First post on here so be nice
I had a similar scenario with our sharepoint development. I needed to lock students out of the "StaffNet" web application. The easiest way I discovered is to goto Central Admin, Web Applications then select your web application and select "User Policy" from the ribbon. This is the only place in sharepoint that you can block users from sharepoint...
I would then use the AD group container for all your other users other than staff (if you have one) and select Deny All. You could in theory deny all for everyone then grant specific users access using this. Also be aware any permissions set using "User Policy" are set in stone. No permissions set in site collections will override them.
I am not sure if foundation allows the above but I would have thought so..
Cheers,
Chris