What we've done in our school is: we enrolled all the chromebooks to the domain and pushed the network configuration via
https://admin.google.com ; under
https://admin.google.com/AdminHome?fr...
Make sure you have selected the root of the organization. Then Select the "For devices" instead of the "For Users". It is right above the "Organizations".
Once all chromebooks got the authorized network and configuration.
You can disable the open wireless network from the controller.
in the BYOD schema, you can authorize access to this open wireless network only to get the configuration pushed to the chromebooks. Throttling the speed or giving access to only google.com domain and subdomains, but nothing else can be accessed.
The open network could also have a time out after half an hour of usage, the mac address is no longer accepted. This is enough to get the configuration pushed from the Google admin console to the chromebooks. For us it required only 3 minutes.
Cheers