Unwanted saving of proxy credentials
I'm not sure how to prevent the creation of the credentials in the first place, but you can remove items from the Keychain using the security command, which is easily scriptable.
The command you want is security delete-internet-password -s server, where server is the hostname or address of the proxy server without the protocol (i.e. 192.168.0.1, not https://192.168.0.1). Alternatively you can use -l label to match the name of the keychain item, or various other search parameters, which you can find detailed on the man page.
You can have this command run at logout for each user by saving it as an executable script in a location readable by all users (make sure the file is executable for all users as well). Then run sudo defaults write com.apple.loginwindow LogoutHook /path/to/script.