If the user accounts that the students use are in Active Directory, you could remove cached local accounts from the Macs and unbind those Macs from AD.
In my experience, students are known to plop down at unused workstations and plug in their own laptops to do work, to be near their friends and classmates. (I've seen them unplug lab computers and leave them unplugged, to make room for their own uses for the outlet the lab computer was using!) You'll probably need some kind of physical barrier to using the workstation space to prevent it from being dynamically repurposed by your users.
