Well, that’s what you are doing with ssh tunnels and remote browsers. If you want separation, they can put your computer in their router’s DMZ (demilitarized zone), so it doesn’t have access to their devices. Additionally, If you use the Tailscale IPs (or host names) instead of their local IPs on his network, they won’t ever change.