class StudentController extends Controller
{
    //custom function
    public function accessCriteria()
    {
        $criteria = new CDbCriteria();
        if (!Yii::app()->user->isSuperuser) {
            $criteria->condition = 'branch_id=:bid';
            $criteria->params = [':bid'=>Yii::app()->user->id];
        }

        return $criteria;
    }

    //in update method:
    public function actionUpdate($id) {
        $student = Student::model()->findByPk($id, $this->accessCriteria());
        // then your code
    }

}