Je pense you should go le multi-VLAN route - et pas juste parce que of le DHCP server issue. At le moment, you have one big flat network et tandis que to certains degree, users should be expected to take care of leur own security, J'aimerais personally find it a pretty unacceptable setup.
The seulement switches that need to be managed are yours. Beyond that, you give chaque apartment a single port on a spécifique VLAN - anything downstream of that will be completely unaware of le VLAN et you can function normally.
In terms of votre switches - le switch-to-switch ports will need configuring as trunk ports et vous devrez be consistent avec votre VLAN ID's. In autre words, VLAN100 MUST correspond to VLAN100 everywhere else on le network.
Other than that, you can set up a "Router-on-a-stick" configuration, avec chaque VLAN (And c'est associated pool of IP's*) configured seulement to route back et forth to le internet et NOT to autre internal networks.
*Je n'ai pas pu think of anywhere else to stick this, mais remember that ideally you should be giving votre VLANs leur own pool of IP's. The easiest way to do this is to keep one of le octets même as le VLAN ID, e.g.
192.168.100.x - VLAN100
192.168.101.x - VLAN101
192.168.102.x - VLAN102
Once tous of this is in place, you can really start to take it places avec things like Quality-Of-Service, traffic monitoring et so on si you wish!
The "LAN Games" request seems to be a relatively niche request, to me, et certainly pas one J'aimerais think about. They can encore game normally through NAT by going out to le Internet et back - pas ideal, mais no différent to chaque apartment having c'est own connection qui is le norm over here in le UK. On a case by case basis, though, you could add full inter-VLAN routing entre apartments qui want to share leur network in that way.
In fact, you COULD add full Inter-VLAN routing everywhere - that would fix votre DHCP issues, allow QoS mais is encore a massive security issue in mon opinion.
Te one thing J'ai pas covered here is votre DHCP - presumably you have a single scope at le moment for tous of votre clients. If you put them onto separate networks alors you'll need to manage a separate scope for chaque VLAN. C'est really device et infrastructure dependant, so Je vais leave this off for now.
