I can confirm that DG is correct, when simply selecting the 'Lock' option this locks all connected Student devices.
If a Student was then to try and bypass the lock state, by putting the device into sleep mode, the Student device would re-enter the lock state once it was back up and running (woken up).
Unfortunately, this does not work in the same way if you individually lock a single Student or group of Student machines.