can 2 routers 1 ont even work? the 1st router has to authenticate with the tm provided ont

just utilize guest networks features provided by the router, which segments the entire network off just for guests

vlans might be overkill, at most you just need a vlan for "untrusted" devices like staff own devices (but I suppose they could use guest network) or iot devices

if you vlan off your printer then your devices cant see the printer....