What are the measures I can take to protect my network and the other devices on it?
Create a guest LAN if your router allows it. That's enough for this case.
Should I go for wired or wireless? (Speed and coverage area are not an issue yet.)
It does not matter. What does matter is if your router can create a guest LAN or not. If that's possible, put your friend on that guest LAN and you are good to go.
What are the things his company IT could know about and access from my network and what can they exploit?
They can do as much as anyone direct connected to your network, because by using your friend's notebook they are inside your network. Without a separated LAN, every device can be scanned, attacked and compromised.
But can does not mean will, and on this case, is far from it. No sane company will randomly scan and target any third-party network. Even you stating that you are paranoid, the company is surely more paranoid than you. A lawsuit against a company for hacking a third party without permission is something no company will want.