Yes, with VLANs and managed switches. But if you don't already have managed switches, you'd have to replace both of them. By far the cheapest solution is to put a small wired router (e.g. I've owned a TPLINK ER605 that would work, performing routing and DHCP) between the ONT and SW1, and then reconfigure the WiFi-Router to turn off the router and DHCP functions, leaving the internal switch functional and allowing the WiFi to serve as an Access Point.