Safe to allow students to access Terminal.app in a shared environment?
It's important to realize that students already have other avenues of access to the bash (and other) shells. Students can download alternate terminal programs—such as iTerm—to their home directories to gain shell/CLI access. Additionally, shell scripts can be run via Automator.app.

So, especially for enterprising students, blocking the default Terminal.app hasn't bought you much from a security standpoint.

Really, whether CLI access is appropriate comes down to the intact permissions across the filesystem combined with appropriate user account settings. If the students are running as standard or managed (non-admin) accounts and filesystem permissions are intact, then that's what limits student access. Non-admin accounts shouldn't be able to run root-level tools and modify root-level configuration files.