Restrict Roaming Users Access

Where I work, we have users who work on the internal network and roaming users who work out on site, but reguarly visit the office. The users working on the internal network have their internet access restricted so they cannot access anything malicious. However, the roaming users internet access is not restricted. My boss is keen for the roaming users to be able to come in the office, and have wireless access to certain files/folders on the file server and printers on the internal network. However, he is keen that they do not have full access to the network as they could have malicious files on their laptops that could infect the whole network. What is the best way to go about doing this? The only solution I've been offered so far is to have a completely separate network with a file server that reguarly synchronizes with the internal network and to have seperate printers as well. Has anyone got any better ideas?