Firmware lock, a good idea or a nightmare?

Sounds to me like some kind of hardware problem, if it was just the OS itself you would be able to boot from some kind of external device if it lets you past the firmware password.

@gerardvanschip As @Look said, if you hold down the Option key when powering on an EFI locked Mac, it should show you any bootable external device in the boot picker once you've entered the EFI password. If you do manage to boot from a macOS installer that way, you should turn off the EFI password before re-imaging as it's been my experience that imaging an EFI locked system doesn't work. If even a bootable macOS installer hangs on startup you may be looking at a hardware problem.

We create the firmware password for all of our student MacBooks, since the student IDs are all Standard users. We don't want them to be able to boot into single-user mode and change their account to Admin. Which we had a few students do before turning on the Firmware password.

As mentioned, holding down the Option key will bring up the prompt to enter the firmware password. Once entered you should see a list of bootable devices: internal partitions, attached USB devices, and accessible NetBoot / NetInstall shares. We have never needed to disable the firmware password prior to reimaging any MacBook from one of our NetBoot shares with Casper Imaging installed.

If an attached USB device is not showing up in that list there are just a few possibilities: The device wasn't initially detected and just needs to be unplugged and replugged. The USB port is bad on the MacBook. The USB device / cable is bad. (Probably a few other less possible items as well.)