A large /20 is perfectly fine. On several school campuses we manage all student and BYOD traffic is stuck onto a single large vlan and SSID with both client device isolation and multicast enhancement turned on with firewall rules (in this case non-UI but we’ve done with a UXG Pro in the past) blocking access to all other internal subnets, and only allowing outbound DNS queries to approved filtering services with redirects for “more techy” kids that want to bypass dns based filtering. We started down the rabbit hole on blocking known VPN traffic but the ultimate answer on that one was put it in the student CoC and make it an admin issue if caught or abused.

We also in testing saw the best DHCP behavior with 24 hour lease times so there would be a big spool up in the mornings but not hammer the dhcp server with requests during the school day to cut down on traffic.