I realize this is an old question but for anyone else coming accross this here is probably the best solution (in my opinion).
A couple people suggested a VLAN (Virtual Local Area Network). The idea here is that you can take a 24 port managed switch and configure it so ports 1-12 function as a seperate switch and ports 13-24 function as a seperate switch. So once you segregate your ports then you assign ports 1-12 a VLAN ID and ports 13-24 a second VLAN ID. VLANs work having the default VLAN (no VLAN being enabled) as VLAN 1. VLAN 1 has access to everything on the network (by default because everything is considered connected to VLAN 1).
So let's say you have servers that you do not want the contactors to have access to. We put all of those servers on ports that are assigned VLAN 20. Put all of your company workstations on VLAN 20 too. Now create a guest network VLAN 40. The contractors would connect their computers to VLAN 40. As it is setup currently VLAN 40 cannot communicate with VLAN 20.
Now create a third VLAN for printers that both networks should be able to print to. Put the common printers on VLAN 30. Setup routing so that VLAN 20 can communicate with VLAN 30 and VLAN 40 can communicate with VLAN 30. VLAN 20 and VLAN 40 cannot communicate.
That will give you the solution you want. To do this you need layer three managed switches and you need to properly configure VLAN tagging, trunking, and IP routing on the related layer three switches.
Hopefully this helps someone in the future. Please let me know if you have any questions.