(Disclaimer: I am Exa Networks Operations and Technical Director, oversee the development of SurfProtect, and was pointed to this post)
To answer your question regarding keeping RM while looking at SurfProtect, running filtering services back-to-back can be tricky, and finding problems in such a setup can be complicated. Therefore, I strongly advise against it.
Regarding SurfProtect Quantum+, you are correct that we can set up the proxy via PAC, but we have many ways to integrate with schools, including VPN.
On Windows, we can integrate with AD, which does not require the user to authenticate (as it is done automatically via challenge). We also have a Windows application that can auto-log customers on our captive portal, and then we can use AD, Enta-ID or Google SSO.
We recently improved our analytic features and notification, so I would rather let someone from our technical support team discuss features with you; they deal with the product daily and will answer your questions better than I can. Feel free to contact them. We are happy to answer questions without involving anyone from our sales team.
We are also launching an offer allowing customers to run the proxy on a local device while making a decision and keeping all logs on our cloud service.
I would be happy to provide you with a 3 months free trial of SurfProtect if you wish to test it at no risk. I will let our team know of this offer.