Blocking the internet but having functional computers

[jose2292]

I teach in a school that needs a secure environment where students cannot have access to the internet unsupervised.  We use Apple computers and an Open Directory setup.  For a number of years we have used pfsense captive portal to block internet to most users and grant internet access to those that need it.  However, with each OS update, the client machines seem to get more and more dependent on having internet access and behave more and more flaky when that access is blocked.  Is there a way to find out what domains my client computers are trying to access "in the background?"  If I could give a pass to those domains I may be able to get them to behave better.

[dhipo]

this not about captive portal
to block domains and sites you can use several approachs
Squid, Rules, Snort
you must know these and do rules

i have several configs like this

[jose2292]

It is about Captive Portal in that I want the captive portal to be active and blocking all users from the internet but want to figure out which hostnames I need to allow to cause my client computers to behave less flakily.