Instead of having them point directly to the scripts on your site, have them use an SSI exec that points to a script on their own server, which in turn pulls data off your own scripts. You can then verify the customer's access by their IP address.

Though the proxy script could be really simple (basically, use LWP::UserAgent to pull the data through and print it to STDOUT), your customers might not want to turn on SSI execs.