If you have a flat network you can't segregate the traffic.  You can create the SSID's you have listed, but they will be mapped to the vlan everything is on.  If you are using AD and want to authenticate with that, then I suggest you also have a radius server and you need to also use 802.1x.  Devices that connect need to support 802.1x.  I don't know what devices you have nor what it can or can't support, but in an ideal environment, all your staff laptops are joined to the domain so you can push out the wireless GPO.  Students and Guest, well that depends on what you want to do with them.  Students are also in AD, but you will need to supply instructions on how they would setup their devices to connect. if you plan on using 802.1x.

Might be best to talk to your local SE to help plan what you need to do.  Typically we would sit with a customer for a couple hours or a day to gather information to determine the best setup.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"