PEAP-Public is an option.
Instead of a PSK, the user would enter the key as both the username and password. You could then direct them to a captive portal to register.
It's not open, but is a public access method with enables their traffic to be encrypted.
Otherwise you will need to use two SSIDs.