Need recommendation for mesh/AP solution for guest network with IPTV

[krabbe]

Hi - first post in this forum

I live in a 350m2/1150sq ft house over three floors. In the first floor we have a apartment that we are going to rent out, with included internet and TV. Also we're soon getting a new ISP.
We're getting our first tenant soon, and would like to get a secure and functional solution to the problem.
Ideally I would like the tenant to have access to internet, and IPTV - but not 'our' network/devices. The apartment have a physical network outlet.

Our new ISP is(very likely) using a zyxel vmg8825 as a router. And as ISPs tend to do, very little can be changed in the ways of settings.
If we enable bridge mode on the router from the ISP, LAN ports 1-3 changes to a separate VLAN for TV signal only and port 4 to internet only. If I don't enable bridge mode, all 4 ports 'send' internet and IPTV traffic.
As we only have a single ethernet cable to each wall outlet, and we have multiple TVs, decoders and other devices bridge mode might not be a good solution?

My idea was:
Use the router from our ISP, but disable WiFi functionality.
Get some reasonably priced routers/AP/mesh devices, with ethernet backhaul and at least one spare ethernet port each(preferably two or more)
Place 3 devices - one in apartment, one in 1.floor main house, and one in 2.floor living room. Maybe place a forth device later somewhere if needed.

So what kind of equipment would i need to get coverage on both internet and TV to all areas of the house - also the apartment, while keeping the tenant unable to 'see' my devices.
I've already ordered a switch with VLAN capabilities(TLSG108E) to connect to the 4 wall outlets.

Any advice and tips are appreciated

PS: My first thought was to place a router in the apartment, and double NAT. But I realized that would probably only make him 'invisible' to us, not the other way around.

 

[L&LD]

The best advice I can offer. Don't offer your internet connection to anyone you rent to and are not responsible for (because legally, you will be).

Let them arrange for their own ISP service, which makes them legally responsible for their online actions.

Problem solved.

 

[krabbe]

The best advice I can offer. Don't offer your internet connection to anyone you rent to and are not responsible for (because legally, you will be).

Let them arrange for their own ISP service, which makes them legally responsible for their online actions.

Problem solved.

Thanks for the reply!

Everything you write is very true, but also very expensive - This would reduce the rent with about 120$/month.
And while I'm in theory legally responsible, all legal practice(where we live) actually says that we're not.

While your solution obviously is the best from a technical standpoint, I need to solve it in a more financially practical way

 

[krabbe]

Would this be a viable solution:
Have the Zyxel router from ISP not be in bridge mode.
Connect WAN port on apartment router to LAN port on Zyxel
Connect WAN port on a separate router to LAN port on Zyxel for 'my side' of the network

This would obviously be causing to cases of double NATing - but it will completely separate the networks?
Are there huge downsides to double NATing in terms of performance or other factors?
Is it likely that IPTV etc will work through double NATing?