You might attain some separation by having different IP addresses, though your router would need to know about the two ranges and, for example, have DHCP keep separation. That's not standard for routers, though @MrSaffron's suggestion might help.
However, keeping IP ranges separate doesn't stop devices being visible at the MAC level.
Another way would be by having a switch that treated the separate (wired) segments as separate VLANs, so traffic from one wouldn't meet the other, except when going to the router. You generally need a switch that is a step up from the minimum.
For example, the plain Netgear GS108, 208 or 308 models wouldn't do this, but the GS108E model would do. A GS108PE could be used to add PoE power if you want to minimise box counts.
Is a single AP going to be enough to cover all the public parts? If not, you might need to contemplate a wireless AP that adds some more commercial/enterprise capabilities (such as roaming) so multiple APs can use the same SSID.
Is the AP going to support 2.4GHz and 5GHz radios? For a simple, home-based, setup, I'd recommend separate SSIDs for each radio. However, for something used by the public, you might want to err back to a single SSID, but have those enterprise capabilities that keeps devices on one radio or the other.
In these kind of "slightly complex" AP scenarios, I'd probably steer you at the Ubiquiti Unifi AC range (lite or LR models). It might need you to run a "controller" to coordinate enterprise features across multiple APs, but not for single APs.
Ubiquiti has a forum for questions of setup, which you might find helpful. I found this example thread...
but it is for a more complex case than you want.
I currently use an Xclaim Xi-2, which is also in the "simple, entry-enterprise" category. However, price changes over the last year have favoured the Ubiquiti now.
I'd probably look at a switch that coped with VLANs, a Ubiquiti Unifi AC Lite (or LR if more distance needed). A PoE switch (with the style of PoE matching the AP) would simplify things. Then I'd connect everything into the switch, so the router only had a single port in use, connecting it to the switch.
PoE should work with gigabit, providing care is taken to match the style.