Why not use adb
shell and look for the process id of that update manager software and uninstall it or even disable it?
Do you know the name of the package responsible for the update?
Two ways I can think of
pm uninstall com.motorola.xxxxx
OR
pm disable com.motorola.xxxxx
Trouble is, if the student in question is extremely inquisitive and leans towards Android hacking... well, this will be the weakest thing you can do, since the tablet would be outside of your control and all hell breaks loose if some student happened to allow the upgrade to proceed!
Another way that has its advantage/dis-advantage:
pro: Reliable!
con: temporary root under ICS, un-heard of!
Why not use a temporary rooting procedure (its temporary and will disappear on reboot - z4root is one I know of that will allow it but 100% uncertain if it will work with ICS), the idea is - to obtain root temporarily, and nuke the updater from the /system/app
directory and cleanly dispose of trailing data and what-nots associated with the updater apk.
Then that should put your mind at ease.
Trouble is, really, you're dealing with such inquisitive minds and they will invariably find a way around the lock-downs, unfortunately... :D
It sounds like a lose-lose case here which is outside of your control since those tablets are coming in and going out of school into the student's home that has wifi etc.
One thing though as a recommendation, by-pass whatever powers-that-be that has approved the budget for the tablets and go direct to Motorola and ask them is there a solution and explain the situation to them to see if they can knock up something to prevent it from happening? Surely on their end, they can blacklist certain known serial numbers or something...