How do you stop students using social media on school tablets?
Leave social media apps off the group's app list, because only allowed apps run, and rely on the filtering DNS to block social sites in the browser. Install guard removes anything not allowed that arrives later. Blocking beats allowing, and the rule applies to phones and tablets alike.
On a Skie device, apps are allowed by list, so social apps are off unless an admin adds them. A student cannot install them: the Play Store is shown or hidden by policy, unknown sources are blocked, and the install guard silently removes anything not allowed that appears after enrolment.
The browser is the second route. Social networks work in Chrome, so the filtering DNS needs to cover social categories, or the browser needs to be off for the group. Pick a filter that fits your policy, and use the effective policy view to confirm what the group has.
Where a school wants social apps blocked in some hours but not others, schedules do that. A hostel might allow messaging in the evening and nothing during study. The first matching window wins, and windows can run overnight.
Messaging apps need a decision of their own. Parents often want a student reachable. Calls from allowed numbers can be permitted, and a calling-only device can leave only the dialer. WhatsApp can be allowed by window or list, if the organisation chooses.
Practical tip: publish the rule and the reason to students and parents, and explain how to ask for an app. Students accept limits better when there is a clear way to request an exception through the organisation app store.