Tips for managing safe and insecure PC mixes [closed]

I'll assume that all the PCs and printers are connected to managed switches that are VLAN-capable. If that is not the case, there is little you can do until you change that.

At each site, create three VLANs: Work, Home and Guest. Trunk the 3 VLANs across the fiber link and to the firewall, so the firewall is the default gateway for each VLAN.

You can then assign each port to the correct VLAN, depending on the type of device on that port.

Now you can create policies on the firewall to isolate each VLAN. As a start, I suggest you allow all VLANs to reach the Internet, but don't allow devices in one VLAN to reach another. That way, you can keep home and business devices separate.