There's no requirement that you have all that initially. You can start out any way you want with minimum hardware and support software. However, you'll find that it's more and more difficult to add this stuff later, especially if you pass the costs on to the customers. For example, if you don't use bandwidth management, and a few customers get used to hogging the entire 16Mbit/sec all night, you're going to have problems with them if you suddenly decide to cut their available bandwidth. I've found it best to start off with tight security, draconian restrictions, aggressive abuse enforcements, and intentionally limited bandwidth, as it's much easier to remove restrictions, than to add them later.
Full disclosure: I'm no longer involved in the WISP thing. The problem was that very cheap DSL arrived and we couldn't compete with wireless.
Yep, I remember (but not the specifics). Bandwidth management simply means assigning a bandwidth limit to individual customers depending on how much they pay per month. Plenty of ways to do it in the router. Please note that I said "bandwidth management" and "abuse detection". I did not say "bandwidth throttling".
Abuse detection is really quite simple. Sniff for viruses, worms, spambots, and other malware. If detected, block the account until the user calls support (that's you) to ask what happened. Also leave a phone message or email. You're doing them a favor. Other forms of abuse are a bit more difficult to deal with. If you don't have the terms-of-service established defining what constitutes abuse, you should not other enforcing some random unstated policy. Set the limits, monitor the traffic volume, and enforced it uniformly. If they want more traffic per month, let them pay more. With simple traffic limits, you should have no problems with monitoring and enforcement.
It probably is too much for you to do all this. Just the log file reading alone is a major time burn. In effect, with wireless, you're doing everything that a land line ISP needs to do, with the added bonus of a marginally reliable delivery mechanism (which can be trashed by one leaky microwave oven). If you can't get cheap help (i.e. students), outsource the function to a network management company. Note that all the local WISP's have most of what I've mentioned.
By the way, congratulations for having remained in the WISP business for so long.