Deploying & Managing iPads in K-12 environment?

Question

I'm a systems administrator for my K-12 school district which has 20 locations. We're starting to get more and more ipads every year, and figured it's about time we nail down some sort of system to manage these. Currently teachers are doing their own purchasing and syncing, but we need a standardized system.
Here is what I'm going to suggest to my IT manager and cirriculum department:
-We will Active and deploy a base "image" to all new iPads in central office with Apple Configurator
-We will deploy a Meraki profile to each iPad so we can remotely manage them.
-We will have to log into the app store on each iPad under a general iTunes account that we have setup.
-The base "image" will have all of the apps that they want.
-Users will submit requests for additional app installs, and we will use Meraki to deploy them OTA with the VPP codes we receive.
-Teachers will have to enter the general iTunes account password on every iPad to allow the install of the app on that device.
Does anyone have any suggestions for this? We want to be able to manage VPP codes, devices, etc., and don't have a budget for a more popular MDM provider at the moment. I looked into purchasing an OSX Server, but it looks like the profile management ***** on it since it can't deploy apps properly and isn't a true MDM setup.
The other thought process was having one mobile Macbook that would travel around to each school to allow them to install apps via USB to the devices. (Our district doesn't have money for Macs in each location). Our budget at the moment is $1,000 or less.
Another question I had was in regards to in-app purchases. Can these be done via VPP or will there need to be a credit card associated with the iTunes account in order to purchase those?
Any help is appreciated. I'd rather do this right the first time. I'd love to use the profile management portion of OSX server, but it looks like it's not quite there yet.
Thanks

Answer 1

The problem you might have is easily getting them on wireless at different locations
assuming each location has a different wireless ssid and password
I use apple configurator to deploy latest ios onto the device along with with minimal configuration profiles, just enough to get the device on the wireless, the rest I push out via MDM
apple configurator profiles:
auto join device enrollment profile
enrollment wireless profile
trust cert
I use OSX profile manager
my enrollment wireless is only for getting the IOS devices configured
I then use PM to push out the wireless settings mail, LDAP, vpn etc required for the user/device
with auto join enabled on the wireless profile , once the enrollment wireless is turned off the IOS devices join the pushed wireless. if a user is deleted from the device, the wireless settings are gone also
I can turn the enrollment wireless back on and it'll auto join and I can then push out the new configuration
I have basic needed apps installed, on a master itunes account. staff can use their own itunes accounts for any other apps and they can recommend apps which we look at distributing
IOS 6 seems to have removed the need for user authentication for updating apps
that can be both good and bad, depending on if you need users to stay on a particular app version.
from what I've seen with OSX PM if you push out an app update users don't need a itunes password
they just need to tap yes to accept the update, this is an opt in, if they choose no you can't update the app and have to push it out again
I would think VPP in app purchases would need credit on the itunes account either via credit card or itunes gift card, I use gift card so there is less of a worry about itunes getting hacked
I think the traveling macbook would soon become a pain