I did some testing with your build and I was able to turn off broadcasting of the physical interface without the virual one disappearing.
What do you mean by securing the main conection? Which encryption protocol did you use? Some don't sem to work, but you can use WEP, see this article: http://hotspotsystem.com/deskpro/kb_article.php?ref=1364-WLXB-3087
