@Virgo thanks for your suggestion. I have ordered a switch with vlan settings (my current ones don't have this) and hopefully the ability to separate lans will make it work as I hoped. I found a site...

I have set up my CPE220 and enabled IP Isolation, as I do not wish those connected to see shared folders on my main network. But, once I connected a notebook to the CPE, it could still see the shares...