Well, that’s what you are doing with ssh tunnels and remote browsers. If you want separation, they can put your computer in their router’s DMZ (demilitarized zone), so it doesn’t have access to their devices. Additionally, If you use the Tailscale IPs (or host names) instead of their local IPs on his network, they won’t ever change.

Yes. EBay and Amazon have a certified refurbished thing with warranties for a little more money, or monitor local classified sites if you can inspect them. I’ve bought a couple off Kijiji here in Canada, which is a bit like Craigslist and Facebook marketplace. The sellers didn’t advertise that they were a business selling off-lease stuff, but you can tell by the number of laptops they post.

Find out if there are any corporate off-lease machines being sold in your area. USFF machines are frequently used as mini desktops or point of sale computers then sold off for peanuts when warranties are done. Especially look at i3-8xxx generation, as they don’t support windows 11 fully.