Greetings,
Given the above-mentioned ethical and legal issues, would it not be simplest to look at it this way...!?
There are three scenarios which would be of concern to anyone responsible for a network:
1) Removable media to the network;
2) Network to removable media;
3) Removable media to removable media.
In all three cases, any files - whether programs or data - have to traverse the network.
It is at this point - on entering the network - that one not only has the ethical and legal right, but also the practical capability to detect/prevent such activity.
As has already been mentioned, combining judicial use of GPOs and suitable software (anti-virus/anti-malware/HIPS) will suffice.
Once the pupils realise this, they'll be less inclined to take chances with getting into trouble.
However, having such policies in place is your backup position.
Making the pupils aware of the existence of such policies - and the consequences of breaking them(!) - is the real deterrent.
Kindest regards,
James
