Restrict Domain User Logins

Sounds like a big roll out.

My advice, keep the local account on the machine for now. God forbid something goes wrong with domain binding you at least have that.

I too have been looking to restrict precisely who can and cannot login to a particular machine. While I haven't personally fully tested this yet, in Configuration Profiles there is a "Login Window" payload which would allow you specify specific users and/or specific groups that can or can't sign-in. All you'd have to do is scope the profile to the machines you want.

I tried using this feature, but could only add under the "Allow" from a Staff Domain, when searching. I need to be able to add a local Admin account and a generic student account (from a Student Domain).
Any suggestions?

If you require a none config based solution...
Put the following script in a policy set to the login policy, scope Limitations to the users you want explicity to prevent, scope Exclusions to users you explicitly want to allow.
You might want to select Make available offline to ensure it runs when the JSS is not visible.
It's certainly a bit of a hack as it doesn't actually prevent login, just logs them back out again immediately, it's also rather old and hasn't been tested since we moved to Configuration Profiles, which means 10.11 and 10.12 have not been tested at all....

#!/bin/bash
if [ "$3" ]; then
/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -heading "Access Violation" -description "Access to this computer is denied for the current username $3" -windowType fs &
sleep 5
kill $(ps -e -U $3 | awk '/loginwindow/ && !/awk/ { print $1 }')
killAll jamfHelper
fi