So, are you saying you want family devices on one network and your own stuff on another and for them to be separate and not talk to each other?
If it is, the way we did it is that we have a multi-port intel ethernet card on the firewall/router (OPNsense).
Port 0 goes to the ISP cable modem and is the WAN connection.
Port 1 goes to our local gigabit switch for our LAN; everything is wired. Address space is separate from the WIFI network (example: 192.168.0.1/24)
Port 2 goes to a WAP that our tablets and dad’s phone can connect to to get internet access. Also any visitors can (with a password) connect to it to get internet. This network has a separate address space from the LAN. (example: 192.168.1.1/24)
The firewall rules we set don’t allow communication between the WIFI network and our LAN.
If your family also has wired devices, you can connect a switch to Port 2 and connect the WAP to that switch, then they can have both WIFI and wired.
Our LAN has DNS and DHCP provided by a Synology NAS, but you could use whatever for that. The DNS forwards to the ISP.
The WIFI network has DHCP provided by OPNsense on that port (Port 2). It just provides DNS forwarding to the ISP and doesn’t see our LAN’s DNS.
@PhaseLockedLoop has a pretty interesting and comprehensive post about their network setup, which is a lot more than you’re looking for, but still really educational and I think will give you some context too. 