Banning Workspace isn't super clear. But Google Workspace is what they used to call G Suite and Google Apps and maybe one more name.
That includes the sign on to the computer and the device management to enforce limitations, it includes Google Docs, it includes Google Drive which is where persistent data is typically stored for a Chromebook.
If you elect not to use Workspace, there's no way to control and monitor the use of the devices. If the users login to the devices, they'd need to use a Google account, which presents the same data storage issues, so everyone would need to use the devices as a guest; but I'd bet guest use also results in unrestricted telemetry being sent to Google; and again, there's no way for the school system to manage the devices (which could enforce telemetry settings, perhaps) with users logged in as guests.
On the other hand, a windows Active Directory based system might run with servers hosted by Microsoft in Azure (and probably subject to similar concerns about data access by US governments), or it can be done with servers hosted onsite by the school system, or it can be outsourced to a provider within the country or economic area.
Apple computers are frankly unsuitable for this market; device management is poor. Open source operating systems could be setup however you like. Someone could setup a ChromeOS fork where the server hooks didn't need to go to Google, but I haven't seen it if it's been done. ChromeOS devices can usually run other OSes (if the other OSes support the critical hardware and the device can be convinced to boot in a method condusive to the other OS), but it might be labor intensive to setup at a school system wide level. You'd also need to come up with a different choice for productivity apllications as I don't think Google Docs would be easy to get working without Google.