Best way to setup Web and Firewall rules for a college

Hi all,

We are in the process of moving to Sophos XG from our existing firewall and web filter solution. 

As a college we have a few different setups for our proxy/web filter and I was wondering if it would be possible to replicate or create a similar setup to what we have currently. I will try to explain our current setup:

We have four main zones/locations which are represented by the following:

• Staff Corporate Network - 172.16.0.0/16
• Student Corporate Network - 172.16.0.0/16
• Staff WiFi BYOD - 10.16.0.0/16
• Student WiFi BYOD - 10.16.0.0/16

 The above four areas allow different categories. For example, on Student WiFi BYOD we want to allow games, but on the Student Corporate Network we do not want games to be allowed. Because our staff and student corporate network is in the same range/VLAN it is going to need to apply policies based on location and Active Director groups, is there a way to build this up? For example, all of our staff are in a group called "All Staff", all students in a group called "All Students". 

If anyone could offer a little advice on the best way to set something like this up and where to go, it would be much appreciated.

Thanks in advance.