With a Chromebook, there is one thing to lock down. On a Mac, there are a lot of things to do, because the whole point of it is that it's a normal computer.
Every decent Chromebook the past several years can run a full Debian. I’m guessing the one thing you’re mentioning is disabling that feature. There are still client-side firewalls and some other settings to change to lock it down further for a school.
On a Mac, you do need to set up multiple settings in your JAMF profile but it’s only one JAMF client run to apply all the rules.
