Bit of a hammer approach, but you could schedule two cached once per day policies with client side time limitations that simply changed the permissions with something like.
chmod 700 /Applications/App Store.app
to turn it off and
chmod 755 /Applications/App Store.app
to turn it back on
You would want to make them cached otherwise it wouldn't turn the access back on again.
You could probably also do the same pretty easily with a launchdaemon that periodically either checked the time and or checked whether it was on the school network and performed the appropriate action if you wanted to divorce it from Casper.
