obviously the best solution is to run an ethernet cable.
if one has coax cable already could use that with moca adapters.
also because its indoors and if there is a clear line of site, you could use p2p wireless bridge look at mikrotik wire, you could get close to 1gbs speeds.
tplink deco do 3 unit packs, friday sales are here.
i would use a small firewall appliance with the features you require,
the major known brands with support will be expensive eg palo alto, or fortigate.
however small brands eg Firewalla will work nicely
or if one is it savvy could build their own with pfsense.
another path would be to use a cloud provider eg zscaler
best solution would be to run some extra ethernet cables around the house and attach a WAP where there is a weak signal.
product eg tplink deco, will allow mesh and backhauling.
lan to lan ports...
my preference would be to get a WAP, if you are wanting to extend the wifi
directly connect the nas to pc on the 2.5gbe. use the 1gb connection for anything else.
best solution would be to get a multi speed switch with 2.5gbe
best solution is to run an ethernet cable and add a wireless access point
any other solution eg powerline or wifi boosters may or may not work.
the ISP provided hubs are fine, if you need more ports buy another little switch.
depends on how far the other place is.. best is to dig another trench and run some SM fiber cables out there.
or if there is a clear line of sight to install a p2p wireless bridge eg from tp-link, or ubiquities
tad old, but the concepts would be the same, as long as you know the foundations to then build upon. but you wouldn't use that if you want to pass the current ccna curriculum
in general, if you want to separate networks vlans would be required so a managed switch, and if one wants security, get a firewall something like pfsense
usual discussion if possible dig a trench for SM fiber.
for p2p wireless bridge; Ubiquiti, mikrotik, and tp-link has some good products.
have you asked the technicians as they are supporting it? and would know its setup.
with most home user connections, it would need to be configured for authentications, its not simply plug and pray.