Firstly, if you don't want unpaying wifi users, change your WPA2 key (or employ such security if you haven't already).
In terms of simply limiting bandwidth, it depends on your router, but many firmwares have built in support for QoS management - Quality of Service. In this, you specify around 85-90% of your maximum connection speed (the one in from outside) and set some rules by which other devices are assigned their portion of your total bandwidth. Using the slightly lessened total bandwidth allows the router to queue traffic more efficiently and provide better service to the devices.
Check your router's web interface. If it comes with QoS, it'll be in there somewhere. If not, it is possible to perform with another device, but this means that device must route the traffic around (essentially replacing your router) to achieve the result.