SharePoint is an excellent option for constructing a functional extranet site; however, the cost of licensing may be prohibitive depending upon your particular deployment scenario and user authentication requirements. A simple Windows SharePoint Services site hosted on a Web Edition server is easy and inexpensive, but a more complex site requiring the features of Microsoft Office SharePoint Server or domain authentication can be considerably costly to properly license.
There are several peer-to-peer file sharing options which may meet your needs...
I have been quite pleased with Windows Live Sync (http://sync.live.com) for basic file sharing. The client is lightweight and available for both Mac and PC. The price is right, and I've had good success using it to keep files in sync between multiple home and work computers as well as sharing documents and photos with others. I've used it for several years (it was an independent service called "FolderShare" before Microsoft acquired it) and have had no problems with the service.
Another similar option (again from Microsoft) is Live Mesh (http://mesh.live.com). It's still in 'beta' but seems to be widely used (like many of Google's 'beta' services)... Mesh is much like Sync with the addition of a 'Live Desktop' where files live "in the cloud" and can be accessed from any Internet-connected computer via a web browser. There is a 5 GB limit to the amount of data that can be included on the Live Mesh desktop--the limit doesn't apply for folders not synced with the Live Desktop. The advantage of syncing with the Live Desktop is that you can access the files it contains even if your 'host' computer is turned off or not connected to the network.
Neither of these 'peer-to-peer' solutions is truly server-based so they may not meet your needs. Both of these solutions require a Microsoft Live ID for authentication and provide basic security features (e.g. encryption for data in transit; read-only or read-write access on a per-share basis). Of course, once the file exists anywhere other than on the computer servers you control, all bets are off on what happens to it or who has access to it--not sure how that figures into FERPA requirements.