I would second the option to just virtualize many firewalls. I have a cloud solution for clients running on vmware and I have my internet pipes vlan'd on the network so I can just spool up a pfsense per client.
The downside, you would need much more than an E3. I almost went the "super-firewall" route using a server with dual E5-2630v4 and 64GB of RAM with 8x 240GB SSDs in a RAID 10. But then decided to just use smaller virtual firewalls on my main ESXi servers.
A managed switch, even if it is just a "smart" switch that can handle vlans on the internet side as what I call a "dirty switch". VLan your internet pipes, lets VLAN150 and VLAN151. Then I would route that to dual servers, single E5-2620v4 with at least 16GB of ram or a dual E5-2620v4 with 32 GB minimum. Then load ESXi and set 6 total firewalls with 50 VLANs each.
You can use something like pfmonitor to manage all of those virtual firewalls.
You could conceivably even have 300 virtual firewalls, I would have more powerful servers. Maybe a stack of 3 dual-proc servers running full vmotion and such, like ESX Essentials Plus.
Or at that point, just do straight up L3 routing with a dedicated external IP per ethernet port dorm. Then let the kids put their own firewalls and wireless networks in. Sure it causes congestion, but if it works in high-rises in NYC. Heck I live in a suburban neighborhood with 53 other houses on my street and I can clearly see a dozen or more wireless networks.
