Suggestions on segregating an office network

So an office I support has a few empty offices and the owner wants to rent them out to other businesses.

Currently the whole building is on one big network as it's all one company, but he wants to segregate the network so everyone is on their own secure network.

There is the possbility of just hauling in a seperate internet connection for each office and sticking then on their own routers/switches, but it would be nice to segregate them on one network file wise because there is an office network copier that we would want everyone to have access to...

So outside the obvious security on the individual computers, what ist he best way to do this on the network side?

I was thinking maybe stacking routers or getting a router that can handle segregated subnets by MAC address or something?

Haven't done this before so suggestions appreciated!

poor man's choice: double NAT : Internet - main router - several "branch" routers for different companies' networks and each branch router has its own dhcp and private IP scheme on the LAN side.

normal setup: layer 3 switch : Internet - router - layer3 switch(es) with port-based VLAN configuration.

anything more than that you're going to have a machine room and hire a contractor to set everything up.

+1 for going with say a Cisco router, feeding to a Cisco Catalyst, say 12-24-48 ports depending on the size of the office, or hell even multiple 24-48 port switches and segregate all traffic via VLANs. From there you can set up iptables to filter out the traffic you don't want, configure your open ports and as a side measure can even set up local software firewall, antivirus, antispyware, etc on the office machines.