As you may know, most consumer-class wifi routers and and their factory firmwares do not offer full VLAN support. That said, most of them
do provide simple guest network functionality (which underneath is usually implemented via some mix of ACLs and/or possibly an actual VLAN). If your friend can suffice with that, then most any wireless router or mesh product will do.
Beyond that, you're options are fairly limited, more so by operator skill set than anything else. There are options (which I'll mention below) that natively include both VLAN and ACL capability, but the administrator is going to need at least intermediate-level network knowledge and/or a strong willingness to learn. If that's the case, then one such option is OpenWRT, which can be found preloaded on routers such as the small but capable GL.iNet series (example: the
Slate), or more powerful/expensive options such as the
Turris Omnia 2020. There is also the likes of Mikrotik, whose RouterBoard models offer a plethora of all-in-one form-factors, and RouterOS is as fully-featured a routing/firewall OS as you'll ever find anywhere. Again, though, any of these options are going to require moderate to serious chops in order to be able to administrate them.
I hope that helps to paint the picture of your options, at least a little bit.