Tricky seperate network

Hello guys,

Following problem: I'm living w/ my gf in a relativly new apartment but it has no RJ45 Ports in any room (they should be punished for this). Just coax in living room and bedroom. Now in my room i have my ongoing homelab-stuff (managed switch, minipc, firewall, working laptop etc.). My gf don't want network-cables laying around (even when laid to my room properly). Main Router (FRITZbOx) is in the living room. In my gf-room is a wlan repeater (fritzrepeater 1200ax) with outgoing LAN cable to her pc). I have one repeater in my room aswell. The same one. Outgoing LAN is going to the switch (at the moment).

Soooo: how can i archive having my own network, so if i do something crappy, she isn't affected from that.

In the next days a minipc w/ 3NICs is arriving (i3 5010u) that i wanna use at opnsense. And i also got a tplink er605 (bought it before i got the minipc).

My plan atm: From the repeater-outgoing LAN (192.168.x.x) into the minipc w/ opnsense on WAN, then LAN (10.10.x.x) into the managed switch. From there to the other devices. Some of the devices should have access to the internet, but not all of them. That way i still can have VLANs on a bit weird way, but it doesn't affect the normal network.

Note: we will move next year into another apartment (hopefully with good cabling)

Is that possible? What would you do? Don't punish me, newbie talking.

Thank you all in advance.