MacBook Air Using Only 20MHz of a 40MHz 2.4GHz WiFi Channel – Solutions

Strictly speaking, access points are a L2 device. Their primary function is to bridge 802.11 WLAN traffic to 802.3 Ethernet traffic.

However, in the real world, enterprise wireless vendors often push more functionality to either the AP itself and/or tie them into a controller, with the end result that they often incorporate functionality from higher layers as well.

I don't entirely follow #1, but neither the connection to a switch or router nor the use of CSMA-CA has anything to do with their function as a L2 device. It is a L2 device because that is the layer of the network where it is designed to function. It doesn't care nor need L3 or above to operate and allow devices to communicate (again strictly speaking).

As for #2, yes, an AP (or any bridge) needs to keep track of which interface any individual device is connected. In general (and simply), they work on the principle of frames destined to an associated station gets forwarded out the wireless interface and any other frames get forwarded out the wired interface (or sent to the controller).

You seem to be going about this the right way (which is the only real question I can find in your post), but I will throw in a few more considerations and/or options.

1. With this many APs deployed and as many users as you expect (and the other non-802.11 devices they bring with such as bluetooth), what is the noise floor in 2.4GHz? It may be that your noise floor is in the -70 to -80 range, which means that "usable" signal outside the room is nominal.
2. You mentioned RF paint (or mesh), behind the APs. Another option to consider is using it on all walls and deploying two APs per room (for redundancy and extra capacity). You may also need to use it on ceilings of rooms below. However, test any product before using it widely as some do not work as advertised.
3. You mention that your transmit power is set to the lowest setting (2dBm) and your antenna is 6dBi. Since you can't turn down the transmit power anymore, you could consider a lower gain antennas or use attenuators to further decrease the signal strength. You will want to make sure that you are able to produce enough signal for a good connection (and high data rates) for a range of devices that will likely be found in the room.
4. Test. Test. Test. High density deployments are a challenge, and the challenges change all the time as technology and the types of devices users bring into the environment are always changing. Unfortunately, you can't just set it in place and walk away.
5. Realize that there will be problems and issues. This is just a fact of life in an environment where you don't have control over devices that will be brought onto your wireless network. Keep a list of device details that have been reported as having issues (type, make, wireless chipset, driver version, OS, what steps resolved the issue, etc) as this will allow you to start finding trends and general solutions so you can provide information (i.e. "try these steps" or "avoid this hardware") to your support staff and/or end users.
6. Subscribe to mailing lists and utilize resources such as forums and industry blogs regularly to keep aware of problems that might be the result of OS updates or other problems. Some examples: Educause wireless-lan mailing list (probably applies since you are an education organization of some sort), Aruba Airheads forums, Ubiquiti forums, Cisco Wireless-Mobility support forums, Ruckus Room (while a number of these are vendor sites, there can be very good information on them and many wireless problems will apply to other vendor environments as well).

Good luck.