Unfortunately there isn't a option to be LAN only with just the C8 and the Ecobee Thermostat. You will need a intermediate Homekit hub like a Homepod speaker or Home assistant to make it fully local. When the Ecobee is controlled with Homekit it is local only. There may be a future update that will enable Matter support that will be local, but it hasn't been released yet as i understand it. You could just use a Raspberry pi to create that Home Assistant server and Home kit bridge.
As far as the Hubitat goes the reason to use Ecobeee Suite is that it has a built in helper app that will do exactly what you want. If you used the built in Ecobee integration you will need to create the rule in Rule machine. Ecobee suite is also able to enable alot more advanced functions than the built in integration. That said both depend on the cloud
You will also likely want to set the password on the thermostat so the users can't change it otherwise they can easily override whatever you do. I would also suggest some kind of speaker device you can do announcements on.
You may need to keep a validation rule checking those things to to make sure the thermostat stays in the right state based on conditions incase it is changed.
It may also be useful to consider adding a clause in the rental agreement that indicates if you can validate excessive abuse of the ammenities like overriding the thermostat, and leaving all the windows/doors open that an additional fee is applied. Then you just need to collect the sensor data so it can be audited at check out time.
