Jake,
The Mobility Access Switches do not currently support the "deny inter user traffic" command like the Mobility Controllers. I believe this is what you were referring to in your original post correct?
However If you are just trying to block P2P between your students (in fact all traffic between them) versus P2P traffic between your students and the outside world (which is more tricky), you could craft an ACL attached to the physical ports or user-roles to block the student L3 networks from each other and only allow access to their respective default gateways.
Best regards,
Madani