For how many users there will be I would recommend that there be a Domain Controller (DC) at each branch and main office. If there is one at each school than I would recommend that there be a backup for each DC. This is based on if one fails that the other will back it up without using the bandwidth from one of the other schools. This well help the load controller to manage the load better as well. There are also many things that could go into this like what is the pipeline that connects the schools or how much IT support each school will have. If the schools lack IT to support I would recommend a read only DC, however if they have IT support I would recommend a read and write DC (Microsoft, 2009).
What this would do is help manage the Domain from anywhere in the network. I feel it is important to have backup for everything in the network. My reasoning for this is the money up front will be lease then if something fails and takes down the network for hours this could cost a company a lot of money. If the schools have IT support I would go with the read and write DC. This would help manage the Domain and things on the Domain could be change if needed.
It is best to have at least one Global Catalog at each campus. This is important, because what is does is stores a replica of all directory partition in the forest. I am big on if you have server role or server you should always have a backup for them. This is why I would recommend two Global Catalog servers at each location too allow for backup. It sounds like a lot of equipment, but more than one server role can be on Windows Server 2008 (TechNet, nd).
This is where I get a little lost I know it is better to have the FSMO roles on as few of the computers as possible. So from what I understand is that these roles would be better off on one DC. I would put them on one domain controller at each school, however if one fails at a school it would use the tunnel to connect to another DC. This will allow business to run smooth tell roles can be put in place on the backup DC. These roles can be manage monitored, and implemented using Widows server 2008 roles also tools like Role transfer and Role Seizure for Managing FSMO Roles (Microsoft, nd).
If the Global catalogs or FSMO roles are not implemented right it could put things at risk like passwords or even the security of the network overall. There are many things that go into setting up Global catalogs or FSMO roles. So it is important to learn how to do this to help secure the network and also help the network run without any problems or very few problems. It is also important to have backups and that is why it is important to have things in place like the Global catalogs.

Reference Page
TechNet. (nd), http://technet.microsoft.com/en-us/library/cc977998.aspx
Microsoft. (nd), http://support.microsoft.com/kb/223346
Microsoft. (2009), Microsoft Office Academic Course, Lesson 4 (page 79-96)