@Joakim77
Thanks for the picture, it helps a lot.
Yes, the box with "telenor" on it must be ISP Router. It is connected to Ethernet switch TL-SG105E.
If this setup was done by the Internet provider, they did it right - for a single household. With your tenant that won't work as he will have access to at least part of your home network.
I can tell you how it can be done right, see if you can do that.
You will need to rearrange things so that ISP Router, switch and Main Deco are connected the following way:
You should not put Satellite Deco in tenant's room, as tenant will have access to Main Network through Deco Ethernet port. Instead, assuming the room is part of your house, you must place Satellite Deco outside that room, on your part of house, but very close to tenant's room. By the wall, floor, ceiling separating that room from the rest of your house.
Find the place for Satellite Deco from where tenant's room gets good WiFi coverage. Also, in that Satellite Deco check its Signal Source with Deco app to see if Satellite Deco has good connection to Deco mesh.
Enable Guest network, password protect it and provide tenant with SSID/password of Guest network.
-----------------
I can see on the photo that there are two blue Ethernet cables, which are not connected. If one of them goes into tenant's room, or can be extended to tenant's room, or even terminates very close to it, there may be other options for providing WiFi to tenant. Let me know.
Also, I can't tell from the photo, but is there one or more available Ethernet ports on that "telenor" box? One is taken by cable from router to switch, but there is usually more than one Ethernet port on a router. That's important to know to figure what options you may have.