In my world ( k-12 ), forbidding access to the network is generally frowned upon. One of my main goals in switching to Aruba is to be able to segment school owned devices from student devices. We have limited bandwidth here, only 10/10 fiber for a student base of over 900. Which is much better then when I started, we had 4/4 then.
But due to the costs of upgrading and the lack of fiber competition in the area - we are likely stuck with 10/10 for the foreseeable future, even with more handheld devices popping up each day.
So my plan/hope/desire is to setup trusted and non-trusted devices, and limit bandwidth. I might even take it one step farther and put teachers and student devices in seperate groups so I can more preciselly control bandwidth when needed - during testing time normally.
We haven't received our aruba gear yet, so i'm not 100% sure what I can and can't do with it yet. But I also hope to be able to restrict iCloud, which with as many non-trusted iOS devices we have floating around could potentially negatively impact our network - with limited bandwidth.
I'm extremally jealous of the schools who managed to get extremally discounted gigabit internet into their buildings :)