Kinda late to this discussion, but if you’re allowed to open up ports, you can have students do a SSH tunnel into the school network where you have a lan zoo?
But if VPN isn’t allowed this is probably no good either?
An alternative idea is have the school creates placeholder accounts (user1@xyz.au, user2@xyz.au…etc) with cloud zoo then give login info to the students? when the year/term ends you can simply change the password then have next year’s students use these accounts?
But I think this goes against McNeel’s licensing terms.