It would be fantastic to use ZoneDirector Roles to set a specific VLAN ID in a way similar to RADIUS Dynamic Vlans. This would allow provide greater management for the DPSK community without needing to implement RADIUS.
School with Onboarding portal SSID - student authenticates through portal and DPSK is generated for student SSID - Student SSID has "Dynamic VLANS" - the DPSK generated for a student in yr7 would be for a different clan than a student in yr8, yr9, yr10 etc
This way the network management would then allow routing / filtering based on the year group without needing a separate SSID for each group.
It also avoids the RADIUS complexities in a BYOD scenario - avoiding 802.1x certificate installation.