I still find that dumb that you even need to do that. Machines especially for schools should be able to have software policies set directly on them to limit such sites.

I don't know how much chromeOS is configurable and if you can e.g. force it to only use specific network and network interface, or if a student can connect it to a different network somehow, because it would be kinda pointless otherwise.