|Just off the top of my head using the following statement as your main goal.|
"What would be the ideal way to set up the network so that each class can access the server but not be allowed to access any folders outside of the folder for their class?"
Based on the above statement, I would say you don't really need too fancy of a setup. I would recommend a domain, preferably with dual, redundant DC's if budget allows. A domain allows for centralized control/administration.
You can achieve the above goal by using shared folders, user/group accounts and permissions allowing and restricting access to the shared folders as need be.
There's no need for subnetting and VLAN tagging in this case since all you seem to need is the ability to allow/restrict access to data.
What you need most of all is somebody who knows how to do the adminstrative tasks which you obviously don't. How much this would cost is hard to say. You could call a couple consultants and ask them for RFQ's (request for quotes)
As for future internet connectivity that's really not a big issue. When the time comes, you buy a SOHO Router and connect your internet to it's WAN port (and get it working of course) and then you would connect a LAN port on the SOHO Router to a port on the switch that feeds all client/server PC's in your environment. Change your DHCP server to give out the router's LAN IP as the "default gateway" for the clients and they'll be accessing the internet. I could do this in about 1 hour.
It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.