Thank-you page could be restricted, but not in a way that the person that just paid can't see it. Make sure that the user, after payment, will be able to access the page. It's fine to restrict access from others, but no the guy that should see it.
For example, if the user paid through PayPal button, when he comes back to the thank-you page, he may still not even have created an account, so any restriction you put on the thank-you page would prevent him from seeing it, and have him sent to the Membership Options Page.
What registration page are you referring to? WP's default or s2's pro-form? Do you want Open Registration or not?
The Membership Options Page is the one page that will always be public. Home page is usually better to keep public, too, although it could be protected and everyone sent to the Membership Options Page.
Does that help?