Yeah, there's enforce DHCP which you could try? Came out around 6.1.x I think? Might get you around the issue if the students don't try the next bit (which would be to inject DHCP from the client, and then set a secondary IP on it). You configure it under the associated AAA profile. If they cause more trouble, put them on another VLAN where they can deal less damage if possible?
Don't confuse this with dos prevention under the VAP. That's something completely different, which means the APs ignore disassociate message from clients (which can be helpful in some circumstances, not in others).
Thanks.