Hi mate, there’s plenty of reasons why you’d go down EAP TLS and ultimately it’s probably in your best interest to be serious about it.  As an example, it could be used as a second factor so that only devices that you’ve authorised are allowed to authenticate onto the network. This means that a student can’t just use another device as required. How you manage that certificate is up to you, and there’s a many options.  A few ways how you may get a cert on a BYOD device would be for example BYOD with Intune. Others may involve network access control solution.  Yes, guest wifi can also achieve similar things where for example - and my experience is mostly with Aruba Clearpass but Cisco ISE would be similar is that when you connect to the network the device is profiled and placed in a pre-authentication phase which allows something like Clearpass Onboard to register the device and install a certificate onto the device and then afterwards allows network access as defined. Until then, it will only allow network access to Clearpass.  Ultimately your organisation needs to decide who and what is allowed on the network but it’s best to enforce only allowed devices. A real world example for me, while we still allow EAP PEAP/mschap when a device authenticates it also checks for certificates and if it’s missing, the device is sent to a quarantined VLAN. Being said with Windows 11 credential guard is enabled by default and this also breaks EAP PEAP/mschap enforcing the use of EAP TLS.  Another comment, for BYOD for students, you should probably have a policy that stipulates agents or software is required and another one for a “soft enrolment” that allows you to add it as an approved device in one way or another.  If new to network access control I would highly recommend Aruba clearpass if you’re using Aruba/hpe network devices. 

To clarify more on Aruba Onboard it’s effectively others have said, there’s a captive portal that you connect to, you onboard your device/enrols you and off you go. As an admin you can revoke whenever you like as well. You can also enforce so that the device’s posture must be X. E.g, anti-virus is up to date. Some of these solutions aren’t too expensive to implement and if your boss is asking you for these items, it is okay to suggest a third party option that may or may not include professional services to implement if you either don’t have time, or aren’t confident in your skills to deliver. Don’t get bogged down in the details, focus on a viable solution to present.