Depending on the age of the macbook there can be several issues.
One I encounter a lot is that if the recovery mode wants to install El Capitan, it can't unless you change the date in terminal, and then fight the internet/installation to get the install done before NTP screws it up.
Knowing that, could you block NTP (port 123) to the network segment / address pool leased to the laptops at a router level and work around the issue? You might even be able to define an DHCP address range for only apple devices.
One I encounter a lot is that if the recovery mode wants to install El Capitan, it can't unless you change the date in terminal, and then fight the internet/installation to get the install done before NTP screws it up.