Securing Server Shares

I notice that many of the standard LD shares have read/write access. We are a school with lots of students who love to play around. If I set a 'Deny' to the share, their machines will not update. So what is the best way to secure the server while still not impacting the ability of LD to take care of its job?

Thanks