I just got off an extended phone call with Apple support.
This is what I learned:
I had to install airport utility for windows on my wife's vista machine. They could not give a satisfactory explanation as to why that was necessary; only that others were successfully solving this problem by installing airport utility. (bad)
My external harddrive is formatted as "Mac OS extended journalled" and successfully seen by vista. (good)
My setting of my tc remains: Secure shared disks with time capsule password so I have to put the tc password on my wife's vista box. (bad)
It is useless to change the security setting to "with disk password" because both the internal disk and external disk have to share the same password. This would still allow my wife's vista box to access the internal drive. (bad) I confirmed this with experimentation. In other words, you can pick "with disk password", but you only get one password no matter how many disks you have.
According to the apple guy Changing the security setting to "with accounts" is useless because it only controls whether a particular user can read or write to ANY disk. That is if I enable a user as rw they will be able to rw the internal disk. (bad) I did not confirm this because changing from "with tc password" to "with accounts" breaks time machine. I am not sure if I had started out with "with accounts" if time machine would have been okay. This is so absurd I do not believe it, but I am not willing to take the time to confirm it myself.