Can't your router block by Mac address? Just limit the Chromebook to allowlisted sites. And also school-issued computers are known for Spyware and even worse. It should probably be segregated in a separate network or vlan.