How can I do this? Private LAN, Hotspot, VPN?

How can I set up the following scenario in 1 location with Mac, XP and maybe even Linux users:

0- FIREWALL
1- PRIVATE LAN for wired 10/100 and wireless users- maybe want MIMO for media streaming
2- HOTSPOT for my customers which cant cross over to my LAN- just Internet access and a printer
3- VPN for my workers to access the private LAN from across the Internet from homes and hotels, etc.

I have a cable modem connection.

Do I need 1 or 2 wireless routers for this?
What hardware is recommended?
How can the VPN be accomodated through this all?

I want it to be simple to administer and flexible for users.

Third party firmware that might make this easier is also an option- not just stock parts.

Can anyone give me some advice or even detailed instructions for this?

Thanks to the experts.