(I'm replying to my own question since I don't know how to delete questions posted in the forum).
In Admin Console -> Spaces -> Space Permissions, select the sub-space. Allow the "Anyone" user to "View Space", "Read Document", etc. These permissions have to explicitly set for each sub-space since they are apparently not inherited from the main space.
Yes, that's right. In a coming release we'll make this switch much
easier -- that is, we'll make it easy to enable guest access overall or
none at all.