Not sure to understand.

1. You can setup your own Google App, but this doesn't mean that Google supports one account mapped to one domain, the Google account used to login is what is taken into account to retrieve the list of domains. So you should have a Google account mapped only to the client domain.

2. Using ACL the JSitemap configuration can be disallowed of course. But if your client is Super User how can you hope to manage ACL for Joomla?

There are no other ways in my mind.