We have done this in the past by using VLANs on the network, then on the LAN connection we change from TRUNK to ACCESS with the correct VLAN applied to the customers end. The rest of the networking (i.e. the routing) is done back inside the WISP network and the customer is oblivious to it.
We also recommend using VLANs in this way to isolate your management network and the subscribers on your network too.
Currently I cannot find in the setup/help documentation on how to force the LAN connection of the Subscribers end to a specific VLAN, this may need a new version of Firmware from the engineering team.
These are some links to help/support documentation
As a alternate solution you can uses a switch on the subscribers side, to help you to “prevent my customer from seeing the inside of my network” as well as using VLANs, you can also use subnets with access to only a small segment of IPs such as 10.11.12.x/30 (255.255.255.252) rather than 10.11.12.x/24 (255.255.255.0). There is a useful tool for calculating subnets at http://www.subnet-calculator.com/ or just search “subnet calculator” in your favourite browser.
We are based in Australia, so feel open to reach out to us to talk about this.
Happy to Help,