I think a lot of the suggestions here pretty solid; you can essentially do them all. I ran a similar setup, but it was not double NAT just data capped so I had to toggle my MAC every now and then.

If you do introduce a switch from the wall, you can at least get your gaming devices directly on. You can then run Wifi network off the router for your phone, and WiVRn.

As others have mentioned though these terms are there for security, your WiFi is a risk to the network. If the school is on your side and you are prepared to mitigate that risk by keeping the router updated and choosing strong auth, you could even tune the transmit power and rssi drop off but I have a feeling if they understood you were going to run WiFi and not just a switch they also would have said no.

So this setup could put you at risk of losing internet I guess according to those terms

Caffe Lusso in Redmond, WA is my go to. Super consistent, super fresh. Not sure what outside WA orders look like but when I order a bag I get one that was roasted that day.