You're right, teachers can configure this enrolmnet plugin to any role regardless of the 'Allow Role Assignments' screen - that surprised me for a bit!
A little investigation and I've discovered what you need to do - just prevent the teacher role from being able to configure the self-enrol instance ('Configure self enrol instances [enrol/self:config]' via Site administration ▶ Users ▶ Permissions ▶ Define roles). Then just keep the Site administration ▶ Plugins ▶ Enrolments ▶ Self enrolment defaults to "Add instance to new courses" = Yes, "Allow self enrolments" = No & "Default role assignment" = Student.
The teachers will have this as a hidden enrolment plugin in their course and if they decide to allow others in they can't configure that course's instance so it keeps the defaults you've set. Of course if a self enrolment needs to be changed from Student to Non-editing teacher then someone with an appropriate role that can configure the instance will have to change it (eg Admin or Manager).
I hope this helps - I know I'll be checking this is in place on our site!