Can you give them their own AWS account? If you’re using any kind of IaC, this should be manageable. Just make sure you charge enough to make it worthwhile taking on extra complexity.