Visvanath:
Our Microsoft AD cloud is technically the entire public education system in the state, but I've restricted the AD scope to our school district. (We're a PK-12 district with approximately 40,000 students and 58 schools.) There is no other authentication system available through LDAP, and that provides our only automated/user-driven account creation, at first login.
We do use our install to collaborate with folks outside of our AD scope, but I have self-registration turned off, and create outside accounts by request. Those requests usually come from teachers in our district. If the collaborators are large in number (an entire class of students outside of our district, typically), I mass-create them from spreadsheet. Although self-creation probably wouldn't be that scary, we do this just to insure we know everybody, since a few courses are self-enrollable without keys (the afore-mentioned teacher community is one).
Our AD does not track brick-and-mortar class membership (which, in the PK-12 world of public education, is pretty fluid, even within a school year), so there isn't any way for us to automate student enrollment. Besides, we don't want online "courses" to be tied to physical classes -- decisions about what constitutes a "class of students" is left to teachers creating courses, and there's a lot of variation there. They are advised to use enrollment keys, or (for very young students) pull them in by hand.
Hope this helps.
Jeff