Routers / Switches :: Setting Up A Network With Separate Subgroups

I have a 4-port Netgear modem/router (DG834), and need to distribute its Internet connection according to the following criteria:

1.There are 11 access points (3 wired, 8 wireless) across 4 floors of a building - all cabling is from a central point, which will connect through a switch.Cat 5e cabling is in place.
2.The wireless points need Power over Ethernet connections
3.The 4 router ports serve 2 PC's and a printer in an office, the fourth being the connection to the switch.
4.There must be network separation so that:
- all points have Internet access
- there are three separate groups - one for the office, one for staff (wired) and one for guests (the wireless points), the purpose being to ensure that no user in one group can access any user's device in the other 2 groups. I'm assuming VLAN is the method for this.
5.Traffic on the network is likely to be fairly low casual use of the wireless ports, the office PC's only being used for Internet access and email no transactional systems, large databases or other resource / network-intensive functions.

1.Both the Netgear FS726TP and GS724TP look as if they will do what I want, using WNAP210 wireless access points. Could I achieve the same outcome with 2 x GS108PE switches? Any other hardware recommendations?
2.Do I need any additional hardware?
3.Are there any other considerations I have not thought of?