Theoretical question - AD / Azure deployment

VickVega, your ideia might work but not as you expect. Look, there's some supported topologies that you can deploy using Azure AD Connect and that will enable your customer to have their credentials (and password) synchronized. 

Have you read this doc already? https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies

Since your customer's clients must connect using their own credentials, I think is worthy to take a look at that documentation. 

Also, creating a structure like *@client1.clients.onmicrosoft.com is currently not supported, since you will only have access to clients.onmicrosoft.com domain. What you can do instead is using a custom domain like client1.clients.com and then assign the users this domain as their UPN like user1@client1.clients.com. The problem with that is that you must have a separate domain exclusively to do this and you must be sure that you won't have any conflicts with users credentials (this might be a real headache).

Last thing is: is the application ready to be integrated with social accounts? would the application be compatible with Facebook, Google, etc? If so, you could try using Azure B2C for your customer to solve this.

Hope you find this useful.

Cheers!