It's not that hard. Make an iOS app and use the remote attestation features to verify the client. In theory Android has similar mechanisms available, not sure how secure they are but Apple's is pretty good.

Now whether you want to restrict your shop to only being accessed via a mobile app is a totally different proposition.

Your first sentence makes sense, but not following your second. Who needs to pick and what are the sides they are choosing between?