Preventing

I want to be able to prevent a “Group” in my Active Directory, “Student”, from being able to use their log in ID and password to log on to Teachers or administration computer systems.

Is there a way to set this up?

I have 15 lab systems that Iwant to allow the students to log into but how do I lock the other 30 computers on campus from student access. But still allow teachers and admin to freely use the computers?