Question about Best practices for Wireless Hotspot

We have the wireless hotspot set up and it seems to be working ok. I have set up the wireless network encryption mode for the guest network to No Encryption and that way the device does not request a password for it to assign an IP address. When the user opens a browser they are directed to the hotspot page where they need to input the password and this works fine.

Is setting the encryption level of the network to none acceptable? Will the system disconnect the intruder who gets an IP address but does not authenticate via the portal after a specific length of time? Is the password sent via the browser encrypted or is this open to be sniffed?

Any pointers? documents? recommendations?

Thanks