I hate some of the "old dog" attitudes. I dealt with it a lot at my first spice job, a family run company employing 9+ family members who had their names on the sign. I was hired right as they implemented programs for their first SQF audit, and they still tried to run after the audit as if it was a 1970's warehouse instead of a 2010 GFSI certified food production facility. Maintenance Manager drives his golf cart through the parking lot and wanted to drive it straight into production area, and sometimes he would put his cigarette out first. Warehouse Manager carries a spit bottle on his forklift while loading/unloading trucks, because "I'm not in the production area." Retired family wandering around the warehouse and production lines just to "see what's new."
In the end, they had to take some hits on their 2nd year audit that came from lack of record keeping for them to see the light. They were used to customer audits before, audits that never really looked at things historically and they could ignore "recommendations" of, so the 2nd year SQF hitting them for not having records from the year really woke them up. They started listening from thereon out, and by the time I left I was actually a little proud of what we had accomplished.
To the OP's questions: If the maintenance guy is indeed a part time employee (of some type), I think you can get away with him not having a visitor pass. But you'll need records of training him on GMP's and the maintenance procedures, which always drove my above mentioned family business nuts... He'll probably argue that he doesn't need training because he's not full time, and the back and forth will continue. As for the granddaughter, there's nothing wrong with employees giving tours, but they'd need to be signed in on the visitor's log. Took a long time for my old company to start signing in their family members who came to share lunch in the conference room, or hang out at someone's desk for the day. It literally took customer audits happening during these family visits for them to realize an auditor is going to see visitors and check the log for them.
From the FDA's perspective, warning letters are common first steps. Do the best you can to try and manage this delicate situation, and then don't be shy about delivering the warning letter to your boss' desk if it ever comes up.