AirPort Time Capsule Security

I just purchased the AirPort Time Capsule. This is my understanding of access to the disk in the capsule - access is possible only if people login to my Wi Fi network AND know the time capsule password. Is that correct? Basically, someone needs to know both the WiFi AND Time Capsule passwords to access its disk.