Problem
ucs@school users being loggend in through Radius have Internet access even though the configuration of rules should deny the access.
Solution
Make sure hte package ucs-school-radius-802.1x is installed on your ucs@school Slave server.
Use univention-install ucs-school-radius-802.1x to install the package.