Input on VLAN layout for K12

County-level MSP managing many local districts/schools, looking to standardize our VLAN layout as we overhaul sites moving forward.

I know L3 to the closet is the new hotness, and we have the equipment to do it, but I suspect that kind of shift in overall process/structure might be too much for my team—but I'm definitely interested in hearing about any successes you've had doing that in K12.

Here's what I came up with for each school site:

• Management - Any managed L2/L3 network device (switch/router/AP)
• Voice - VOIP and/or intercom
• Cameras - IP security cameras ideally with dedicated trunks back to NVR
• IoT - Catch-all for any IP device that doesn't have a user in front of it (and isn't a phone/camera). Think HVAC, sensors, bell system, maybe even printers.
• Staff - All devices used by district staff members.
• Student - All devices used by enrolled students.
• Guest - All devices used by anyone not employed by or enrolled in the district.

Thanks for any input!