Since this is a multisite you'll have to put the disable password filter in a mu-plugin. Create a file in wp-content/mu-plugins with:
add_filter( 'allow_password_reset', '__return_false' );
That should completely disable password recovery. It will affect all sites, not just that one customer's: if that's not what you intended you'll have to add ...
From WordPress Tavern - the article is for WordPress password-protected posts but the final paragraph reads:
This update only affects password-protected posts. WordPress user passwords don’t share the same length restrictions and can be upwards of 1,000 characters long if so desired.