@Joakim77 

"One of the X90's are connected through a switch that is connected to my modem"

Do you mean:

ISP Modem<--Ethernet-->Switch<---Ethernet--->Main Deco

If yes, you may be having ISP router, not modem. It is important, because everyone connected to Deco mesh, even to Guest Network, can access anything connected to the switch. What else is connected to that switch?

"If he connect to the Lan port to this one" - he will be on your Deco Main Network. That is not what you want, I am assuming.

  @Alexandre. 
 

Here you can see my setup.  The internet provider supplied that black box. Not sure if it's a modem or what. The switch is connected to that. Then i have connected one of the Decos to the switch, the rest is to wall connections. 
 

Hope its understandable

  @Joakim77 

Thanks for the picture, it helps a lot.

Yes, the box with "telenor" on it must be ISP Router. It is connected to Ethernet switch TL-SG105E.

If this setup was done by the Internet provider, they did it right - for a single household. With your tenant that won't work as he will have access to at least part of your home network.

I can tell you how it can be done right, see if you can do that.

You will need to rearrange things so that ISP Router, switch and Main Deco are connected the following way:

You should not put Satellite Deco in tenant's room, as tenant will have access to Main Network through Deco Ethernet port. Instead, assuming the room is part of your house, you must place Satellite Deco outside that room, on your part of house, but very close to tenant's room. By the wall, floor, ceiling separating that room from the rest of your house.

Find the place for Satellite Deco from where tenant's room gets good WiFi coverage. Also, in that Satellite Deco check its Signal Source with Deco app to see if Satellite Deco has good connection to Deco mesh. 

Enable Guest network, password protect it and provide tenant with SSID/password of Guest network.

-----------------

I can see on the photo that there are two blue Ethernet cables, which are not connected. If one of them goes into tenant's room, or can be extended to tenant's room, or even terminates very close to it, there may be other options for providing WiFi to tenant. Let me know.

Also, I can't tell from the photo, but is there one or more available Ethernet ports on that "telenor" box? One is taken by cable from router to switch, but there is usually more than one Ethernet port on a router. That's important to know to figure what options you may have.