Denying access to the file system is easy.
Youve obvlsy identified the users you want restriced (students as opposed to teachers).
open up nwadmin
create a group that contains all student user objects (eg. .students.groups.school)
browse the file system by going to the volume object in the tree (eg. .<servername>_sys.school) and go the the folder sys\public\mgmt
right click the folder and select details
select trustees of the object
click add trustee and add the group containing all students (eg. .students.groups.school)
untick read and file scan.
all boxes in access righrs should be unticked.
also untick all boxes in inheritance filter just to be safe.
now all users in that group have no access to the mgmt folder (containing console one)

do the same to:
sys\public\winnt
sys\public\win32
sys\public\win95

and that will deny access to nwadmin.

BTW, the client version doesnt matter, we are blocking users, not workstations.