Does this info still work?

https://www.jamf.com/jamf-nation/discussions/5528/enable-admin-authorization-to-change-wireless-networks

Thanks, that works perfect.

For anyone interested here is what i did.

#Removing Admin Access here
localAccts=$(dscl . list /Users UniqueID | awk '$2>500{print $1}' | grep -v administrator)

while read account; do
    echo "Making sure $account is not in the local admin group"
    dseditgroup -o edit -d $account admin
done < <(echo "$localAccts")
#end of admin access removal

#enforcing Network Change Admin Prompt
sudo /usr/libexec/airportd prefs RequireAdminIBSS=YES RequireAdminNetworkChange=YES RequireAdminPowerToggle=YES

Does this prevent your users from selecting their home WiFi? The solution below uses launchd to make sure the device is connected to the school WLAN when in range. I would think that it could be tweaked to make sure that WiFi was enabled as well.

Managing WiFi on macOS