I see talk of controls for hiding and sharing items on the timeline, and for turning the timeline on and off, but not for only making it available to your friends.
The barrier to entry to browse a user's past appears to be: a Facebook account.
All content on timeline follows the same privacy settings as the object has. So if you have been posting things as Friends only, all of the content will also be Friends only. If you have been posting Public updates, then it will also be Public.
The barrier to entry to browse a user's past appears to be: a Facebook account.