There is no truly good way to secure this type of setup against the building's IT staff whom you also do not trust - not without having separate networks behind a gateway and corresponding network infrastructure that you actually can control (thereby defeating the purpose of the VLAN's existence in the first place) which would then be connected to the VLAN in order to get 'internet' access to the networks behind that gateway.
Since you cannot control the switches, you cannot really control access to the network. You can't implement proper port lockdown rules, you can't implement network-level restrictions, and you can't shut down ports on the switches to protect against access to the VLAN.
In order to really protect a network like this where you don't control the physical infrastructure that comprises the network, the only option would be to run your own network, using the VLAN as an 'access' tunnel to the Internet or other network ranges, with another firewall or appliance behind the scenes connected to your own network of switches and endpoint machines, thereby keeping data contained to within your network's borders.
The other option is unfortunately similar - it would be to set up a secure gateway device running a properly-configured VPN in the VLAN that in turn has everything else behind it except endpoint computers. Endpoint computers then have to connect via VPN to the 'gateway' box, and then they would have access to the devices and information you want to protect.
From there, then depending on subnetting, user authentication, etc. you can configure access to devices within your own 'sphere of control' behind that gateway device (whether it be a Cisco ASA or a pfSense box or some other type of device, is up to you). However, this still necessitates your having a 'second' network that is internal holding the data you want to protect within it, and you just treat the building-wide VLAN as the 'Outside' or WAN connection to the gateway appliance for these purposes.