RonMidwest wrote

Will they need their own router?

Yes, a separate router (or a VLAN-aware router, which is a logical separate router, albeit physically only one device) is usually needed for two separate networks. Remember, VLANs is a mechanism to re-use the same physical cables/switches/routers for two or more networks. Thus, VLANs only exist inside the network switching/routing infrastructure. Regarding it's edge interfaces (WAN1, WAN2, LAN1, LAN2) the VLANs are split up into separate networks much like you would have each network device twice with separate physical cables.

But if the router lets you create two separate LANs and supports VLANs, you can easily share the single WAN interface between two isolated LANs.

If the router isn't VLAN-aware and/or lets you not create additional LANs, you could assign a limited set of IPs to the tenant and use Access Control Lists (ACLs) together with VLANs to separate the tenant's devices from the rest of the LAN network. But I don't recommend this, I always set up two or more separate LANs to create isolated subnets.

BTW: although VLANs can be used to isolate subnets from each other, they are not a VPN, which usually use tunneling techniques.