If you want to limit accessibility, you have two options, as you stated: client IP address range and login.
IP won't work: It's trivial to get the client IP address, but if you must allow students in from their home locations then you can't use it:
Using IP based Geolocation - and why it's pretty much useless.[
^]. If you could restrict it to just "college IP" addresses, it's trivial. Otherwise, it's a waste of time.
To restrict logins, you would need to access the college DB and ensure that your users are still currently on it, or at the very least were on it at the beginning of term.
No other way will work.