You could setup a second WiFi router connected from one your primary router's LAN ports, and set a subnet address different from yours. This would keep him off your network, and give him a separate password.
Some free third party router firmware such as DD-WRT will allow you to do this from a single router - creating a guest network. But need to find a compatible router. You could also set QoS rules to limit his bandwidth usage and net speed, restrict access to certain websites, and also give you primary access when you're on the net. But admittedly, somewhat involved to setup if you've not done so previously.