#1

I would do this by creating a new child site for each customer and then just setting up the user as the adminstrator for the site (which would be able to add users for the site).  If you do not want to do that then the only way I can think of doing this is for you to write your own module used to maintain users that has the additional functionality of limiting what users can be seen by different cusotmers.  You would probably need to use a custom profile field to indicate which customer the user if for and automatically populate that when the user is added based on who it is being added by.

#2

You can create custom permissions that the module(s) you create an use.  To do this add as many custom permissions as your module(s) need to the permissions table.

PermissionCode: Module_{ModuleName)

ModuleDefID: ModuleID or I think you can enter -1 to make this so all your modules can use these permissions.  I have not tried this though.  If setting this to -1 does not work then you would have to create the customer permission for each module that required it.

PermissionKey: The unique key used to lookup the permission.

PermissionName: What shows on the permision grid header for this customer permission.

You can then use the following code to check the permissions in your module for the user who is logged in.

Public Class {MyModuleName}Permissions
        Inherits Entities.Modules.PortalModuleBase

        Public Const PermissionCode As String = "MODULE_{MyModuleName}
        Public Const EditScriptsKey As String = "Permission1"
        Public Const EditScriptName As String = "Permission #1"
        Public Const EditResultsKey As String = "Permission2"
        Public Const EditResultsName As String = "Permission #2"


        Public Sub New(ByVal modInfo As Entities.Modules.ModuleInfo)
            Dim permCollection As ModulePermissionCollection

            permCollection = modInfo.ModulePermissions
            _CanPermission1 = ModulePermissionController.HasModulePermission(permCollection, EditScriptsKey)
            _CanPermission2 = ModulePermissionController.HasModulePermission(permCollection, EditResultsKey)
        End Sub

        Private _CanPermission1 As Boolean
        Public Property CanPermission1() As Boolean
            Get
                Return _CanPermission1
            End Get
            Set(ByVal value As Boolean)
                _CanPermission1 = value
            End Set
        End Property

        Private _CanPermission2 As Boolean
        Public Property CanPermission2() As Boolean
            Get
                Return _CanPermission2
            End Get
            Set(ByVal value As Boolean)
                _CanPermission2 = value
            End Set
        End Property
End Class

Dim tcPermissions As New {MyModuleName}Permissions(Me.ModuleConfiguration)
if(tcPermissions.CanPermission1)
{

    //Your code goes here.

}