To me the whole enterprise is totalitarian, but if I were trying to build a solution, it would look something like this:

1) Add a school control mode to the devices, similar to existing parental control mode. In this mode the school can block categories of content or usage during school hours. The school administrators don’t get to look at the student browsing data.

2) Schools can enforce a policy that unenrolled devices are banned from campus. The device can make it easy to check using something like NFC or an indicator accessible from the lockscreen (similar to the existing medical ID).