If its working?  Why do you want to change it?  What issues are you seeing?  I can always think of other ways to do stuff, but they may or may not be better.

Why do you have all your users in a single OU?  That is a tad unusual...

You can setup Contextless Login with the OES Client.  ZCM Logins are Contextless.

--

You could have a Teacher DLU Policy Assigned Directly to the Teacher Devices.  Set to Include the Teachers User OU  (If you had one.)

Student Devices you could just assign to the student devices directly...since everyone will be an Admin...no need to care if its a teacher or student.

Though most would want Students to only be "Users" and in such a case you also assign the "Teachers DLU"  Policy to the Teachers User OU.  So it will apply even to the Student's Devices.

There are more OUs but in this case both students and teachers are in the same. They are distinguished from each other based on attributes for every other system like WiFi and firewall.

If I had the tool to sort users in to dynamic ZENworks groups (like devices) I could for example tell all accounts starting with s or e to be in one or the other group.

The only ways forward I see right now is to manually sort users into groups. (That is 500+ new users per year.) The other is to rebuild our core catalogue.

This sounds more like an eDirectory Management Question.  There are many ways to automate all this stuff directly in edirectory both at the point of creation as well as afterwards.  While IDM would be one solution, it would likely be overkill with many command line tools available to do all of this from batch files based on the constraints you want....though that would only be needed for after the fact since you can use templates as part of creation so they start in the correct groups right away.