NAT, whether single or double, doesn't have anything to do with security.
Security is ultimately the end user's job. You could just throw up some unsecured AP's, and provide a warning that anybody using those AP's needs to do their own due diligence to make sure they're only communicating with valid servers over valid HTTPS connections, or using a trustworthy VPN.
You really can't make the network itself secure without requiring your users to authenticate somehow. At the very least, basic WiFi security requires the use of WPA2 "Personal" and a shared key. You have to provide the key to every user. You could just hand it out on business cards or tear-off tabs on a bulletin board or put it on a sign on the wall. Even if you try to keep it semi-private, your users are going to share it. But at least individual devices will have a uniquely encrypted connection to the Access Point and won't be able to sniff each other. On the other hand, somebody could set up a rogue AP using the same key, your users would connect to that rogue AP, and the bad guy would be able to sniff all their traffic.
As far as the users themselves being secure on your network, that's really ultimately up to them. They need to only use websites and apps that utilize the HTTPS protocol, or use a VPN. More than that, far too many apps don't use HTTPS appropriately, completely bypassing the necessary checks to verify that the SSL/TLS certificates from servers are valid. Programmers too often have trouble getting the verification checks to work, so they give up and throw a switch that makes the protocol "just work," but at the expense of bypassing the verification checks. When they do that, the packets are encrypted, but they could be encrypted by a rogue key, possibly via DNS poisoning pointing the user at a bad server, with a bad guy picking up the whole conversation in the clear.
So you can't really guarantee secure communications for your public WiFi users. That's their job.