Wireless – Full-duplex with two antennas

You seem to be going about this the right way (which is the only real question I can find in your post), but I will throw in a few more considerations and/or options.

1. With this many APs deployed and as many users as you expect (and the other non-802.11 devices they bring with such as bluetooth), what is the noise floor in 2.4GHz? It may be that your noise floor is in the -70 to -80 range, which means that "usable" signal outside the room is nominal.
2. You mentioned RF paint (or mesh), behind the APs. Another option to consider is using it on all walls and deploying two APs per room (for redundancy and extra capacity). You may also need to use it on ceilings of rooms below. However, test any product before using it widely as some do not work as advertised.
3. You mention that your transmit power is set to the lowest setting (2dBm) and your antenna is 6dBi. Since you can't turn down the transmit power anymore, you could consider a lower gain antennas or use attenuators to further decrease the signal strength. You will want to make sure that you are able to produce enough signal for a good connection (and high data rates) for a range of devices that will likely be found in the room.
4. Test. Test. Test. High density deployments are a challenge, and the challenges change all the time as technology and the types of devices users bring into the environment are always changing. Unfortunately, you can't just set it in place and walk away.
5. Realize that there will be problems and issues. This is just a fact of life in an environment where you don't have control over devices that will be brought onto your wireless network. Keep a list of device details that have been reported as having issues (type, make, wireless chipset, driver version, OS, what steps resolved the issue, etc) as this will allow you to start finding trends and general solutions so you can provide information (i.e. "try these steps" or "avoid this hardware") to your support staff and/or end users.
6. Subscribe to mailing lists and utilize resources such as forums and industry blogs regularly to keep aware of problems that might be the result of OS updates or other problems. Some examples: Educause wireless-lan mailing list (probably applies since you are an education organization of some sort), Aruba Airheads forums, Ubiquiti forums, Cisco Wireless-Mobility support forums, Ruckus Room (while a number of these are vendor sites, there can be very good information on them and many wireless problems will apply to other vendor environments as well).

Good luck.

You should use VLAN and Trunking.

In short you do have to trunk the interface that links the switch and the AP, and the interface that links the switch with the DHCP server. In this way you will have somethink like ethx.y (in a Linux fashion) or Ethernetx.y (in a Cisco fashion) where x is the identifier of the interface and y is the VLAN tag.

On the access point you need to "bridge" every SSID with the sub-interface according to the chosen VLAN.

On the DHCP server you have to define a specific pool according to the sub-interface from where the request comes from, and therefore the VLAN from where it comes from.