Public and Priviate network from same cable modem - more questions please

Question

A couple of weeks ago I asked about having both a privite network and a public wireless network that would work from one cable modem. The requirement is that the private network not be seen or be "hackable" by users on the public network.
Duane gave us the approach to use and we think we have it right, but because the security of our private net is so important, we want to make sure. We will not do the public network if the security of our private network is in danger.
Here is how things look:
Cable modem --> Router 1 WAN port
Router 1 regular ports --> Private Network -and- Router 2 WAN port
Router 2 regular port --> AirPort Extreme WAN port
We have our public network set up as WPA Personal and we broadcast the network name. The password for this network will be shared wiith users as they enter our public area where they can use their PCs. The default login/password on both routers and the AirPort Extreme have been changed. Connecting via AirPort to the public network I can see Router 2 but not Router 1 or any of my computers, printers, etc. when I browse the network via the Finder.
Do I have it right?
Does this setup give users on the public network any way to get to my private network, computers, and files? Are there any tests/experiments that I could run to further validate this setup?
How secure is it?
Am I asking for problems by offering a public network that shares some of the resources of the private network - modem, MAC address, IP addresses of routers, etc.
From the public net we have attempted to use the IP addresses of the computers on the private network without success.
The best answer I could receive is that there is no way to hack the private from the public. If this is not the answer, how secue am I.
Tim

Answer 1

When you state "Router 1 regular ports(8) feeding Private Network..." do you mean that there is another private router or are the private clients directly connected to router 1?
If you have a private router, the public devices connected to the AirPort Extreme base station (AEBS) could address and reach anything on Router 1 including the private router's WAN side.
The firewall in private router should block any of the public access to clients of private router. So any traffic from private router should be safe as long as the public has no physical access to router 1 nor router 2's WAN port.
If the private clients are directly connected to router 1, then the public clients can directly access any of your private clients. The traffic among private clients and from private clients to Internet would be secure (as long as my previous note about physical access is true).