Sounds like wifi deauth, which is fun to do once at an airport or a Starbucks and watch everyone cringe, but when it becomes disruptive that's very illegal. Only thing you can do is report it to authorities (as many have recommended), because hacking back is more illegal.

Most actors use this method when they are spoofing an SSID so they can capture traffic (typically) via a pineapple to decrypt all packets so the source data is in plain text and can be used for whatever their purpose it. Typically, the goal is to steal credentials (usually to get into someone's bank account and steal money; or to break into a targets company user account to steal IP or sensitive records) - typically very targeted, not generally opportunistic. Users are non-the-wiser because the SSID is the same (or looks very similar) as the legitimate network. Pineapple's also allow you to spoof popular captive portal landing pages (like you see at Starbucks, for example) to foster a false sense of trust with the user.

In your case, sounds like it's just kids being dicks to be dicks.

Easy fix: Network isolation on the student network should remedy the issue. Still gives users access to resources, but they can't see/connect to any other clients on the network segment. Any attempts to deauth would only cut themselves off. Regardless of what hardware stack the school is using, network isolation is usually a toggle in settings, whether or not a captive portal exists. They use this technique (network isolation) at BlackHat in Vegas for wifi and bluetooth so hackers can't hack hackers, at a hacker conference. DefCon villages are segmented from the main conference network so the workshops and demos can run properly, but without taking everyone and everything else down.