No, you are completely wrong. Firefox's built-in auto update is disabled on Ubuntu. There is a built in update service which notifies you of updates automatically, pretty much the same way that windows does.

But does that mean on each machine or simply that computers on school property must be filtered?

If it's the latter, I'd recommend filtering things like myspace and facebook via the school's net connection

But to put filtering on the machines themselves is just asking for the students to break administrative restrictions on the laptops. And then some overexcited school administrator is going to press criminal charges for some random computer crime.