SKIPPED Unfortunately some of these students figured out how to disable proxy which was set on these computers, since on OSes we use there is no way how to prevent them to do so. Last line of "defense" remains DNS which system prevents them to change.
my two cents transparent squid + ICAP, ECAP or URL rewriting? or chain to privoxy?