We use enrol_auto to make it easy for staff and students to access pages that are college-wide. For staff it's great, as it can look at a moodle profile field as a restrictor (e.g. we put a Staff/Student flag from their network profiles into the Institution field, and the plugin can say 'only add them to this page if they have Insitution set to Staff'), but I've not seen any settings that will cover your pre-requisites.
Unless you lock a profile field that auto-enrol can use from users editing it, and write a script which runs every so often (e.g. a Scheduled Task on Windows Server) and manually changes the value of that field itself. A bit of a fudge way of doing it, but you might be able to work to something like that?