When I configure the hotspot to use SSL, does that mean that everything that passes over the network to the user's web browser is encrypted, or does it only encrypt the hotspot user's login name and password during the login process?

Only the login page will be SSL. All other internet webpages should come through clear text unless they are also SSL encrypted by their servers.