What I did was to take one of my old wi-fi routers and reflash the firmware with OpenWRT and set it up on another subnet and route it through a VLAN'd port on my switch in the house. Now, when it goes through my main wi-fi router (also reflashed) the bandwidth it can use up is extremely limited, it's port 80/443 access only, and packets coming in from it have lower priority than the ones from the main secured wi-fi router (QoS enabled). The public router also reboots itself every 60 minutes to ensure that no one just sits there all the time.
That way I can provide the local neighborhood with free wi-fi web browsing while at the same guaranteeing my internal network is secure and all my internal traffic takes priority.