Apple Classroom - Separate SSIDs Not Working

Hello everyone,

Our district has two seperate public SSIDs:
CCS Devices (installed via profile)
Concord BYOD (open public network)

While all iPads are told to auto-connect to the CCS Devices SSID, this doesn't stop students from manually joining the guest network.

When this happens, Apple Classroom is not able to see the students if the Teacher iPad is on CCS Device and the students are on BYOD.

We have allowed the ports found in this support article:
https://support.apple.com/guide/deployment-education/requirements-classes-synced-apple-school-edud491bf924/web

Has anyone ran into this before?
Any help would be appreciated!