Start from scratch and do it right the first time. Feed enters home in Basement/Utilities/Comms area. In that area is the main switch where all runs terminate to with at bare minimum 2 jacks at each location but 3 is preferred. 2 allow a router to be placed anywhere, 1 for WAN and 1 for Lan back to switch then a 3rd for an additional device at that location direct to main switch. Extra runs are easy if you're already there pulling wires.
Plan runs for at least 2 locations on opposite sides of the rooms for best layout options. So cables don't have to span doorways windows etc.
Then when cabling is in place a managed switch and router VLANS can be used to separate. Or a 2nd physical switch for the tenant and a VLANS capable router with a port separated to the tenant switch. Then in the tenant space they have the option to plug a router in or you can provide an AP for Wi-Fi. But that will all give you maximum stability, capacity and security.
A vlan router can be as simple as a Thin Client, miniPC or open router appliance with multi port NIC added as needed running OpnSense OpenWRT etc. Those units can be used for anywhere between $25-150 normally and software is free NIC's are cheap