What would be the best architecture for a small school network?

I work for a language school with one internet connection.

The school has wireless, but it’s only available for the staff. I’d like to give students internet access in class so that we can write wikis and use the internet for research, etc.

The management are concerned about the security of their data.

Of course, I appreciate that the best way to keep data secure on a network is to disconnect it from the network, but that’s not an option.

I was considering a router operating on a different LAN-side IP address range – 192.168.2.1, with it’s WAN-side connection going straight to the router that connects to the internet, but as I’ve never done it before, I don’t know how effective that will be at keeping students away from sensitive personal, business and financial data.

Am I wrong? Is there a more appropriate way to do this?