If you want to set the equivalent of a password on the autonomous AP, you can use the PSK modes in WPA or WPA2. That way you set a passphrase that you communicate to your users. However, this passphrase will be common for all of them and obviously must not be communicated externally.
If you want to do something more like having each users authenticating using their own password, you will need a controller to be able to do more advanced authentication. By the way, the controller is also acting as a RADIUS server for a small network like yours, so that you could authenticate using strong encryption schemes, while not necessarily having to bother deploying a "true" RADIUS backend.