Deny login access to domain group

I work at a school where all of the students are added to the "students" security group in Active Directory. We also have a subsets of students (e.g. music, or drama) that belong to separate security groups. So, a student could be a part of the student security group and the music security group.

I am looking for a way to allow only people with the "Music" or "Drama" logins to access certain Windows XP stations. I have tried configuring the Group Policies to deny access to the "Students" security group, but then that prevents the students who are also part of the "Music" group from logging in (since they have both "Students" and "Music" as part of their user properties).

I would prefer to not use the "Log On To..." section of student accounts, because editing every one of the students would take a long time.