I found my issue: the group membership attribute should be "memberOf" instead of member as posted by OP.

Not easily. That is usually accomplished by having staff and student VLANs where you can apply different firewall rules to the traffic. So if it's wifi for example you can have a separate ssid with 802.1x authentication that only staff can connect to.

Steve