Only allowing TLS enabled traffic would protect users from traffic monitoring on the transport layer, but it's still possible to see which servers a user contacts. So an attacker gets server names and he could still gain useful information from requests/response size, timing, contacted servers. But it's very unlikely that an attacker could extract passwords, personal data or cookies from the data.
The problem is, that this protects only from a passive attacker. An active attacker could set up an evil twin, an access point with the same name. He could allow non-TLS-traffic and even try to strip down TLS traffic. (HSTS mitigates this issue for many websites today, but not completely).
That's a problem that all unencrypted WiFis has today and the only solution would be, that the user authenticates your Access Point. You could do this with WPA-Enterprise set up, but from a usability perspective it's too complicated for the users I think. Another solution would be giving an unique WPA-PSKs (pre-shared keys) to every new user. (If you're giving all users the same PSK, an attacker could set up an evil twin again or decrypting traffic if he has recorded the WPA handshake.)
Using TOR would mitigate the problem that you would be responsible for the things people do over your internet connection, but as @yorick-de-wid already mentioned this has a few usability consequences. In Germany as example there is a project called Freifunk, which is non-commercial initiative for free wireless networks. They provide a gateway, where you can route the traffic of your users through. The connection to the gateway is encrypted using a VPN tunnel. I would recommend using such a service, if available in your area.