primary SSID with open or no WEP authentication

What type of security policy should be enforced for the users in the Guest group?