Ok, it's not fool proof, but it can stop them for a while.
I have attached pictures of how I am blocking vtunnel at Kino JH.
Instead of automatically detecting settings I set them up to use proxy roxy 
through port 8000 on all except the secure server. I freeze the computer with 
those settings. 
If any teacher needs their kids to access a secure site, like 
https://www.cia.gov/kids-page/index.html
then they need to open "tools>Internet options>connections>LAN settings> "
then select automatically detect settings.
The kids can work on the site. Then, reboot the computer and it goes back to 
having the secure sites blocked.

See attached pic for more info

I am not having the Teacher computers use these settings. That would 
interfere with some of the programs they need to use.

             ***********************************************
The MPS-LABTECHS mailing list is powered by L-Soft's renowned 
LISTSERV(R) list management software.  For more information, go to:
http://www.lsoft.com/LISTSERV-powered.html