"Hotspot" Schemes?

Hello,

I would like to ask here to all who have implemented "hotspot" networks,
like coffee shops, libaries, etc.; what hardware and software do you have in
place to protect the security of, at least, the Intranet of the providing
enterprise, and perhaps, even the security of each of the transient clients?
It seems to me that there are lots of places that advertise themselves as
"hotspots", but I suspect that not many have implemented standard security
wisdom...

My best guess would be a separate router which is configured to be a proxy
server? Or would a NAT/SPI on the wireless router (s) be enough?

Any replies are appreciated.

Thanks, in advance,

sa