With BYOD you might into the issue with those devices not authenticating through AD (like mine) I have two SSIDs set up one for school owned and one for guest and students so that each can be filtered separately because I do not have a RADIUS server set up yet. My suggestion though would be to have a RADIUS server and just use a captive portal tied into the RADIUS server and authenticate through the firewall with a whitelist for those student accounts.