Part of the answer, I think, depends on whether you have a reliable person designated for managing the machines. If you do, then the best option is to configure them with AUOption '3' (Notify for Installation), and trust that designated person to install the updates at an appropriate time.
If you don't have somebody in the school who can take on that responsibility, then you really only have two other options:
- Schedule the update installation for after-hours (using AUOption '4') and ask that the machines be left powered on. You'll also have to get a feel for how long it takes from approval, thru download, to the time they're ready for installation. You can help with this by scheduling a shorter detection interval (4 hours, perhaps?) for these machines. Using Deadlines on the approvals to ensure they get done within a specified time period is also something to consider.
- Do it yourself. That's at least four days a month out of the office doing "field trips" to schools. Not saying this is a functional solution, but it is a possible solution.