Invalid WiFi password

Easiest way is to create a launchdaemon to disconnects from the wifi when it connects. I am using this method to block students from hotspotting. 

If I'm not mistaken there's an option to allow the device to only connect to networks that are provisioned by the MDM. But that would prevent users from connecting to other networks, such as their home network. If that is undesirable, I suggest the password is changed on the "vendor" network instead of attempting hacks on the client devices. If the main challenge is that the network traffic is unfiltered, then I suggest that filtering is done on the client device itself, as devices tend to move between various networks these days. Or that a global proxy is enforced via MDM settings instead to achieve similar results.

Your method of creating a config profile with the wrong password should have worked. Same vendor SSID, wrong password and auto join turned off. If your student SSID is being affected then you're toggling a setting on that shouldn't be on or something else is going on.