You need to consider, in detail, how traffic will flow in your network. Determine the bandwidth requirements for things like access to intranet sites and file servers, as well as internet access. This will guide you toward how you can plan your core infrastructure so that groups of workstations have adequate bandwidth in the directions they will send traffic, and how you can structure your network to accommodate the concentration of traffic toward certain nodes. Generally the structure should be tree-like, with links directly to traffic concentration points wherever possible.
The second thing to consider is the size of broadcast domains. In general, network performance is reduced by excessively large broadcast domains (as DHCP traffic, ARP, some windows networking functions, and a number of other things cause broadcasts, which can have a cumulative effect. You don't want broadcast traffic being flooded out across every link on your network. Limiting broadcast domains is accomplished with subnetting and planning your layer 2 topology; VLANs can help with this, as can simpler strategies such as setting up a small number of switches to serve a set of related workstations on a subnet, and using a router. Keep in mind that routing and DHCP will typically need to be provided for each subnet. Strategies for subnetting range from departmental subnets to a subnet for each floor of a building. 350 devices is definitely enough that you will need to worry about the size of broadcast domains.
Additionally, you should consider which areas of your network have specific security implications. Obviously you will want to have a specific subnet (and probably VLAN) for your guest network, with firewalls set up to prevent it from accessing internal services. Depending on your area of business, you may also want to use a similar strategy to isolate the networks of some business units from others.
Port security is also important. Consider implementing a policy whereby unused network ports are disabled or placed on a VLAN with no connectivity. Also consider restricting each access port to one MAC address for most ports to prevent unauthorized hubs or wireless networks.
You can add redundancy a number of ways. At layer 2, you can leverage spanning-tree to create redundant links between switches (which in your network graph will appear as cycles), so that when one switch or link goes down, there will still be a path for traffic to follow around it. This functionality is distinct from routing. At layer 3, the strategy is similar - ensure that every router has a secondary path to places you expect traffic to be concentrated at (your firewalls and border gateways).
If there is any specific part of this you're wondering about, feel free to start a new question - but if any of that was confusing you should either study a lot (look at the CCNA study materials for instance) or hire someone else to do this.