There is no simple solution to preventing abuse of shared Internet lines, especially if you want to make sure the line remains useful for the non-abusive users.
What I mean by that is: Many people using a Wifi will want to send emails from desktop email clients, use VPN connections, messengers or make calls using tools like Skype for example.
If you restrict ports to just the canonical http/https ports you will not prevent any brute force attack against GMail / Facebook / you name it but you will render the Wifi hotspot next to useless for many users. Internet isn't just the world wide web anymore for a long time.
Typical measures which are taken on public hotspots are limitations in terms of the amount of data allowed per unit of time. This usually means to implement some intelligent rate limiting algorythms which are once again far from trivial, because if a client sends 100 MB in a few seconds, this will be perfectly ok if it's a video chat, but you don't want to allow 100 MB of spam being sent out in a minute.
In case you don't have the expertise to deal with these issues on an ongoing basis and you don't think you want to built up that knowledge, one very wise decision might be to delegate this to a company which does that for a living.
I don't want to drop any names here but there are specialized companies in all parts of the world which operate a scheme by which you send all traffic from your customer's guests though a VPN connecton to them and they will sort of malicious traffic and delegate the legitimate traffic to the Internet using their publicly routed IP address and not that of your ISP.
Your ISP will only see the VPN traffic and never blame you (cut you line) for anything which got sent over that link unless the pure amount of traffic becomes an issue. But even that can usually be mitigated in the router firmware which that company you will be working with provides you.