You might be interested in ebtables
This guy had the same problem you have :)

I have never tried this but a quick search found that iptables support os fingerprint and the module is enabled in default Slackware kernel.
CONFIG_NETFILTER_XT_MATCH_OSF=m

And from iptables man page:
iptables -I INPUT -j ACCEPT -p tcp -m osf --genre Linux --log 1 --smart

Good luck.

What about the students whose only/primary machine is Android based and therefore shows as a 'phone'

Might be IPhone start with specific MAC address. You can also block such device by their MAC address.