In this mess, is the IT guy using some of the wires that you ran for the network, or in any way making you run additional wires, or not provide services you quoted and wired for, because he has to have his network separate? If so, I'd put it on him to work out how to do his exceptional limited super-fazzap network thingie, as everything was clear and properly cost-estimated until he made his demands.

I'd go so far as to tell him the guaranteed way for him to be totally separate is to supply his own connection to the ISP. Two ISP feeds, two modems, etc; voila, two separate networks. This is not technically necessary but proposing that he should provide exceptional wiring for his exceptional needs, and him working out the guarantee that your network does not "connect" to his, does not seem unreasonable as, basically, his requirements are causing the problems.