The communication protocol for the "Time Capsule" is AFP, a proprietary and rather under-specified protocol defined by Apple. Since version 3.1, AFP may be protected against eavesdropping by wrapping it into SSH, but whether this is the case for your Time Capsule is not clear (there are some conflicting reports as to whether this is doable at all; but, at least, it would have to be enabled explicitly).
You could try to run a network monitoring tool such as Wireshark, on one of your Mac, to see exactly how that Mac communicates with the Time Capsule when it performs backups.
In any case, allowing outsiders on your internal network seems like a bad idea, especially since with an open WiFi you cannot control who connects. In any town, running an open WiFi almost guarantees connections from strangers. Even if your Time Capsule happens to be safe, anything in your network can then be subject to hostile attempts (desktop systems, servers, printers...).
I strongly suggest that you run your "open WiFi" (if you really want one) in a dedicated network zone, isolated from your main network with some firewalls.