Deny users access to certain PC’s

I am trying to deny access of certain OU’s or Users (2,500ish of them) to specific computers. I work within a school and I’m trying to stop students accessing the network via teachers laptops. I know I can do this within AD+C but can only specify what computers they CAN logon to. It looks as if I cannot use wildcards or OU’s as computer names and I am not willing, (maybe just lazy) to input over 800 machine names. all the laptops are named LAP-. I cannot find in the Domain GP anywhere where I can dis-allow logging on from specific users,(maybe looking to hard) or a quick way to only allow then on all the others.
Any help greatly appreciated

Many Thanks