Without knowing what, exactly, has been done by "outside vendor" I'm going to guess that each "company" has a separate VLAN (virtual LAN.) That is the most common way to isolate entities that should not have the ability to snoop on each other's network traffic that share infrastructure.
If you have the password to access the switches you should be able to see if that is the case by examining the switch setup and mapping the port destination to any defined VLANs on the switch ports.
If so, you should be able to make access to any VLAN from any port. Keep your most ethical self in control when doing this. Hmm - actually, if you have "dumb hubs" on the second floor, you may need to upgrade those to a "smart switch" for proper VLAN handling. Or, if there is adequate cabling in the patch between first and second, and switch ports on the first, you just patch on the second floor, using switch ports on the first floor. To know what your options are, you really need to know (or describe) what you actually have, cable-wise.
If you have a VLAN-capable switch on the second floor, one wire can carry 4 VLANs between floors and then the switch can deliver them to the proper wall jacks.
OK. If you only have two cables (which for some reason are both connected from down to up on the "main company - building owner" network, and if you get a smart/managed/vlan capable switch for upstairs (probably only need one, really, at least for the scale of the problem so far) then you will need to set up VLANs on a downstairs switch for the building owner and each client. You'd plug each client into an "untagged" port on the downstairs switch assigned to their VLAN; on (at least one of) the lines running between down and up you have a port on a downstairs switch that is assigned to all 4 VLANS, tagged (which is how one wire carries 4 networks) and that connects to a port on the upstairs switch which also has all 4 of those VLANs, tagged. Then on the upstairs switch you break out the 3 "customer" VLANs to untagged ports which you patch to their assigned wall ports, and the company VLAN to the other ports (or to only the actual ports in use, as a better "best practice" which does require remembering that you need to reconfigure the switch when/if you move cables around.)
With smart/managed switches, the two lines from downstairs to upstairs can be configured as a LACP so that data can move twice as fast over the pair of cables.
First, you might be experiencing a bug which doesn't show the proper VLANs port membership, so check this out and see if a different browser helps: http://kb.netgear.com/app/answers/detail/a_id/23841/~/the-vlan-and-lag-configuration-screens-do-not-display-correctly-on-my-switch.
Second, make sure you are adding the VLANs correctly by verifying with the user guide that you have done the required steps properly. You can find the user guide on the GS748T Downloads Page.
If this still isn't working, I would suggest trying 801.q VLANs. The important thing to know when using 802.1q VLANs, is to set each port to "untagged" mode, assign a VLAN, and set the PVID per-port to the same VLAN ID. This should allow you to create separate VLANs on your Netgear switch. Make sure you keep at least one port on VLAN 1 so that you can still connect to the management interface. Of course make sure you have a router that can route between these separate networks, and either connect a port from each VLAN into this router, or create a "tagged" port carrying multiple VLANs to this device.
Best Answer
In the GS752TP, GS728TP, and GS728TPP Gigabit Smart Switches Software Administration Manual, on page 47:
It would seem that you can shut off power on the port, wait a few minutes, then re-enable it.
Aside from that, it is not a very good idea to have the switches in awkward places. Network infrastructure devices, like switches and routers, should be racked in data closets, and the cabling should extend back to the data closet.