This is what we do too.. Take a snapshot of live source code and DB , Apply a whole lot of capabilities in bulk to restrict students and teachers doing something , change the mysqli type to a custom one that skips writing to the DB and put it on a different site. I have to admit this is not a 100% solution but it covers most avenues of disallowing users to make any changes.
Hittesh