How can I create two separate, isolated wifi networks with one Internet connection/modem?
Apple networks do this well with the guest network. All the "suspect" devices only get to go to the internet and not infect / snoop / attack the trusted machines on the proper network. Many other network vendors have the same idea - either by making separate VLAN for the sequestered / DMZ devices as needed.

It doesn't make sense to address each of the separate questions since each would be a long several paragraphs. Perhaps narrow down on one item once you've chosen to set up your network and can document it and ask the subquestion with details needed for a more narrow answer.