There is no way to configure what you want with that configuration. Your modem has one public IP, so all traffic coming from your home network will originate from that IP. Only thing you should be able to do is separate tenants local network from your local network by using Guest WiFi settings. With that tenants will be able to use Internet but won't be able to connect to your devices (network printers, file shares, smart TVs etc.) you can also limit bandwidth assigned to Guest network.
Edit: I'm not sure about this, but there may be a way to assign different DNS server to your tenants (for example one of yandex's with family filter) and with that you will limit access to porn and other non-family friendly websites. Check https://dns.yandex.com for details.
As for tracking I found EasyPrivacy quite good and for malware I'm using the "safe" DNS servers from Yandex.
As for bothersome ads, adding them to the blacklist usually does the trick for me.