M4300-52G-PoE+ (GSM4352PB) - Partitioning Bandwidth for Tenant

Good evening friends,

First post in the community. Here is the situation.

• Our company has built a new building which I have wired and purchased networking equipment for.
• It is a three story building with a network closet on each floor and a server room on the 2nd floor.
• I am using a combination of GSM4352PB (48 port managed switch) and GSM4328PA (24 port managed switch) on each floor. 
• We have a gigabit fiber internet connection (1Gb Down/1Gb Up).
• There is a 10Gb fiber line that runs between floors as the backbone of the network

Initially we were going to be occupying all 3 floors, but now we have decided to lease the 3rd floor to a tenant. I would like to ask the community's opinion on what the best way would be to:

• Partition the network so that all of the 3rd floor equipment and WAPs are separated into it's own network
• Partition or limit internet bandwidth on the 3rd floor to 100, 200, or 300 Mbps. We want the remaining bandwidth to be dedicated to our company on the 1st and 2nd floor.

What is best practice for bandwidth optimization and security?

I was thinking setting up a VLAN with limited bandwidth or setting up a subnet with limited bandwidth on the ports running up to the 3rd floor would be ways to tackle this. I am aware that there are many ways to accomplish what I need to do, but I am turning to the community to seek out the best way to do this. I am not an experienced network engineer (obviously), but would like to do this in the best way possible. 

Thank you for your help!

Network diagram attached for your reference.