My concern is to be able to maintain security between his computer and ours, such that he has no access to anything on our systems...
That was recently discussed here
, and would require a 2-router setup. Your friend would be on the "Semi-Secure LAN" connected to the first (External NAT) router, while you would be on the "Super-Secure LAN" connected to the second (Internal NAT) router.
With a 2-router setup, your friend would not be able to see anything on your network, however you would be able to see anything on his network.
...or us to his system.
That requires a 3rd router be added, which would function as a second "Super-Secure LAN", to which your friend's system would then be connected. That way the two networks would be *completely* isolated, however both would still be able to use the same internet connection. Scott.