Restricting access to recovery mode

Hi, I'm an IT technician working for a UK college supporting about 500 macs and 2800 students.

We would like to restrict access to the recovery mode, some of our students have been using it to erase the disk's. I understand there are 2 ways to do this - firmware password and filevault. Here's why i cant use those...

Firmware passwords appear to be removed from apple silicon devices? We cant set one and other posts suggest using filevault instead.

Filevault only works with accounts that have been established on the macs already. We use platform SSO, so many different users can use a network username and password to log onto any mac. New users are unable to unlock FV. Filevault does not appear to be usable in a shared device environment.

Is there a way to password protect the recovery mode?

We are using apple for schools and MS Intune as our MDM.

We have a mix of intel and M1, M2 and M3 iMacs on our network.

thanks in advance for you help.