What's the purpose of keeping the untagged VLAN1 and the corresponding "LAN" interface on the pfSense? I can't find it anywhere in the OP's description. I'd get rid of it, personally.
You need two separate logical networks - Staff (VLAN 10, unrestricted) and Students (VLAN 20, restrictive firewall/proxy).
That's two VLAN interfaces on the pfSense and a trunk port between it and the main switch. Then other trunks between the main and all other managed switches. All other ports designated for users should be access ports (untagged egress traffic) belonging to any of those two VLANs.
If you want to have a separate management or server network, just create third VLAN and use it for that the same way as those two. With these switches you should be able to set up some nice stuff, like MAC VLANs so that you can connect your laptop into any port on any switch and always be connected into your management network with its IP adresses and firewall rules.
Mixing tagged and untagged traffic together on the same port should be avoided. It can work and I've done that a few times too, but it's ugly nonetheless.
@MisterVance:
But all the rest of the switches, I have to use their configuration utility, and it doesn't look on other subnets. Would that cause any problems?
They might need direct L2 connectivity between the switches, so they can't talk across different VLANs. I admit I'm guessing here, because I have got only the fully managed higher-end TP-Links (yes, I know, sounds funny) here so no config utility, just the web and command line. Anyway, in that case it would be one more reason to set up a management VLAN where all the management stuff (and your PC) would be accessible together, on the same broadcast domain.
