We use Meraki (huge wireless deployment, so it makes a lot of sense to just use their gateway and call it good) with their blacklists. Biggest problem is it considers too many things "gaming" and needs exceptions-- e.g. lichess and chess.com are OK. Authentication and logging are pretty good.

Rateshaping students to have enough bandwidth to do schoolwork but not to have wonderful connectivity (campus has a 2gbps symmetric connection, but we only give students 4-5 megabits/sec over wifi most places on campus) is also a part of the picture.