If you already started with B then stick with B and ignore what the panel says. If the panel is pre-marked with A color coding and you want to do B then swap green and orange compared to what the chart says.

Easiest fix is to replace the WiFi extender in the basement with another router. The tenants would connect to that one (whether physically or via WiFi) and the network provided by that router will be mostly separate from your own. If none of them are tech-y this should work fine but otherwise still allows them to connect into your network if they know what they’re doing and make an effort to do so. Think of it like a cheap lock—keeps honest people honest but someone with sufficient motivation can still break in.

There are more secure ways but they would involve replacing pretty much all of your networking gear with more capable equipment as you will need VLANs and a competent firewall.

2 caveats of unifi access points:

1. They are designed to be mounted on the ceiling. Putting them high up on a wall can also work, but you want to avoid just setting them on a desk. Think of the signal as coming from them in a very shallow cone emanating from the front of the unit. So if the unit is pointing upwards you’re giving your ceiling great Wi-Fi but your ceiling isn’t usually where you or your devices are. Ceiling mounting means the bottom of your rooms has good signal which is what you want.
2. They are powered via PoE (Power over Ethernet) which means you need either a PoE-capable switch or a PoE injector. Injectors are bulky and consume extra power ports so I really recommend the switch if it’s within your budget.