Lyphiard

Not sure why you'd want two separate access points. Many WiFi access points support multiple SSID's and VLAN's. They can bridge clients connected to different SSID's into different VLAN's on a trunk port. Your optimal setup in terms of security would be finding a router that supports creating multiple LAN's. For example, 192.168.0.0/24 would be for your home LAN and 192.168.1.0/24 would be for your tenants. Both of these can be configured to NAT to the same public IP address assigned by Comcast, but they wouldn't be able to talk to between each other. Simply buying two different access points and plugging them into the same router / LAN won't offer you any real security, apart from maybe the ability to disable your tenant's WiFi individually from yours.

The actual core (not the cladding) on SMF is so tiny I'd imagine you'd have a hard time even using it for that.

What's your budget for a switch? You can pick up a Cisco Nexus 3048TP for roughly $200 on eBay - it has 4x 10GbE SFP+ ports and 48x 1GbE ports. It's enterprise-grade hardware and fully managed (although you probably won't need management capabilities).

I would not recommend using Cloudflare DNS at this point. I'd recommend sticking to 8.8.8.8 and 8.8.4.4. Using 1.1.1.1 won't make your connection any more secure than using 8.8.8.8. I've had issues with it where it's returning the incorrect IP address for Google's servers, possible caused by DNS poisoning or a BGP hijack.