Is A Managed Switch With VLAN Support Required

The central reason for a smart/managed switch would be to actually implement the vLANs. If you use a "dumb" switch or hub you have no guarantees by that device that the traffic is actually restricted to the participating devices in each vLAN.

A quick and simple example. Say we have three devices on a switch (A, B, and C). A and B are in a vLAN; B and C are in another vLAN. If it's a "dumb" switch then broadcast traffic will be forwarded to all ports (A's broadcast traffic will reach C; and vice versa). If it's a "hub" instead of a switch, then all traffic would be sent to all devices.

The next important question is whether you care. If you fully trust A, B, and C to see and communicate with each other, then there's really no "harm" in this configuration. A and C would know they aren't supposed to be talking on each others vLAN and wouldn't. The problem comes when you can't fully trust one or the other, as in the case where one is an Internet connected CPE. At that point you would have to hope that no malicious packets are transmitted over the Internet, vLAN Hopping or whatever is necessary to compromise your network.

Using vLANs without a smart/managed switch has all the security of overloaded subnets (using two non-overlapping subnets on the same broadcast domain). As mentioned above, the lack of security isn't necessarily a problem, though you don't get the benefits of segmented broadcast domains either. One small potential problem is that other people working on this network may make certain assumptions about the security based on the presence of some vLAN configuration - wrong assumption or otherwise, it could lead to a security problem as well.

As long as the companies only share the internet connection and have no need to share other resources (like file servers), I clearly would favor option 1.

If you have separate companies and have become the administrator by chance rather than an external, binding decision for every of the companies, one of the things you would want most would be a clean, well-defined interface / point of transfer. This is what you get by having a single uplink port towards a router with an own subnet (better yet, an own public IPv4 address / IPv6 subnet and another router for them to administer). Each of the companies could choose its own switch and, more importantly, its own administrator for this switch.

If you choose to use option 2, the main disadvantage will be that you will be the contact person for everything for ever. Even if any of the companies are going to employ an own administrator, there is a good chance that it always will be you who is obstructing things, breaking things or not doing things right in their opinion. Expect even a broken toilet flush to be within your responsibility.