|Your best bet is to segregate by using different subnets.|
From the looks of it you'll need two separate subnets. One for "teacher & admins" and anybody who doesn't require access to the shared resources would be in the other (student) group
Workgroups do not provide separation, segregation or security. Especially not if all 3 different workgroups are still on the same subnet. If you can't afford a "Small Business Server" to use to create a domain (recommended) then you'll want to segregate using subnets and/or VLAN's if you have a layer 2 capable switch. You would also need at least two SOHO Routers.
The following is assuming the point is to provide all 3 groups internet access and can't afford an L2 switch or Windows SBS to create a domain.
You would want something like:
Connected to the internet
This is for students and allows internet access only
Connected to Router 1
File server resides here along with admin/teachers
This gives access to internal resources AND the internet but the students can't access this network.
I wouldn't bother with using different workgroup names, it's meaningless anyhow.
If you click on my name above, click on "How-to Guides" and have a look at my guide on adding a second router you'll get basic instructions no how to set this up. You'll want the version wherein you interconnect the two routers LAN port to WAN port and use separate subnets.
It matters not how straight the gate,
How charged with punishments the scroll,
I am the master of my fate;
I am the captain of my soul.
message edited by Curt R