UEM is User/group based all the way, where AppVolumes could be attached via Computer Object. UEM could set condition off a lot of things, like IP address of the device, device name, etc, if you'd like. So if there is a clear IP scheme going for each classroom then it could be pretty easy to create the icons needed for that room and just delete all the icons on appstack creation. Additionally, you could look at app block the apps you don't want them having access to in a room.
Now if you wanted to make say a Desktop pool for each classroom just set AppVolumes to attach via OU and call it a day. So when the computer is created via instant clones the apps will just be layered in and waiting for a student to long in. I do this with RDSH Farms.
Thanks for the suggestion! Our OU is stuctured in a way that ALL virtual machines are in the same OU. They are not separated out by classroom, etc.