Generally, you can just set up an AP and hook it up to your internet connection.
Things to consider:
- Make really, really sure the AP is not in any way connected to your internal network (unless you really know what you are doing). You don't want to expose your LAN to any passersby.
- If you use encryption, you reduce your attack surface because it makes it somewhat less likely for random people to use your AP. This is not really a security measure (any key you use will be fairly public), but prevents annoyances like bandwith hogging by strangers.
- You should do a basic check for legal issues: Does your ISP allow this kind of sharing (some forbid it in their contracts)? Are you legally liable for computer crimes commited via the AP (not in most jurisdictions, but that may vary).
I'd prefer to keep it an open access point, so I don't have to support users who can't figure out how to input the password correctly. However, if I don't, should I use WPA or WPA2? Will I have compatibility issues at all if I use WPA2?
As pointed out, encryption avoids some annoyances, but I don't think it's really critical. If you do use it, WPA2 would probably be ok. WPA has been required for the Wi-Fi Alliance's certification since 2003, and WPA2 since 2006, so recent devices should do WPA2.
What is the best way to isolate the users from the network itself. I guess the most foolproof way is to just put that access points(s) on its own DSL connection. What are my other options?
No need for a separate DSL connection, really. You should at any rate have some kind of router/firewall between your DSL connection and your LAN. Just hook the AP directly to your DSL, bypassing the firewall. Or put it into your DMZ (if you have one), or even better, into its own DMZ.