What do I need to provide a wired guest isolated access to my home network?

I have an AirPort Extreme (APE) with the Wi-Fi setup for guest account and this works just fine. I was wondering if I could also provide a wired ethernet guest access without letting this user see my computers AND without me having access to his computer while plugged into this network as well. I do have a "switch". Could I plug this into my broadband modem (first) then the APE? Would a switch give the isolation I need?