I need some advice on creating a new role. I'm an experience Moodle Admin, but a novice when it comes to Moodle roles. I have a sandbox Moodle site in which to experiment.
Background: Our IT Service Desk staff each have an account with Moodle Admin privileges so they can get into any course and assist our teacher and student users. For the first time, a couple of them are now also taking Moodle courses -- with separate student accounts.
The requirement: I need to create a custom role which will allow me to lock their Moodle Admin accounts entirely out of only the courses where they're students.
I understand the concept of permissions context; what I need is advice on which of the hundreds of permissions I need to adjust in order to fulfill the requirement. (Please tell me I don't need to prohibit everything that starts with moodle/course... and mod/... )