So after talking to our professional services and doing some research, it looks like we'll stick with keeping the schools on separate VLAN.
- From what I can tell the Clearpass solution requires use of onboarding or the Guest module. Our SSIDs are mostly WPA2 personal and don't even use Clearpass.
-Since the Airprint printers are wired, there is no solution in the wireless controlller.
So our network will look something like this:
Lower school building
Employee SSID = VLAN 10
Student SSID = VLAN 20
Middle school building
Employee SSID = VLAN 30
Student SSID = VLAN 40
Something like that to keep the broadcast domains separate. Maybe roaming between building won't be ideal, but it keeps everything else simple.