Considering the current issues encountered in the deployment of 5G private networks, including high costs, imperfect traffic diversion mechanism, and insecure user access control scheme, this paper presents a 5G campus private network model based on Educational Metropolitan Area Networks (EMAN). The proposed solution comprises three aspects: Firstly, a private User Plane Function (UPF), whether physical or virtual, is deployed and connected with the EMAN via dedicated communication links. All schools in the same region or city can build their own 5G campus private networks quickly and economically just by reusing the existing EMAN interconnection lines and establishing Generic Routing Encapsulation (GRE) tunnels between the UPF and the boundary devices of their respectively campus networks. Secondly, a traffic offloading scheme based on private data network name (DNN) and uplink classifier (ULCL) is adopted to realize imperceptible access to campus Intranet and Internet in 4G/5G networks and roaming scenarios. Thirdly, a network access control scheme based on converged authentication gateway is proposed, which effectively ensure secure access control, authorization and comprehensive lifecycle management for 5G private network users. The feasibility and effectiveness of the proposed solution have been validated through its implementation within a provincial EMAN.