@Adzbez I think your description is not enough for anybody to help properly. First what I think about is, your customer can get own controller where a customer can manage its own sites, by that your problem would be resolved and device would appear only in controllers network. As you say billing, I assume there is some backend doing the job automated, that is part which you did not describe as it would be kinda describing how it is already built (or not) and which resources are available for your use case, especially for the case that everybody gets own virtual/non virtual controller.

If you add just sites, then you should remove user ability to add/remove devices, instead your company should do it in the backend and when users want to assign devices to a site, they could do so by mac&site combination. That way you would ensure that only your backend manages devices and assigns them to a correct client only.

  @Adzbez 

You want to manage the devices through Intenret right?

The device will be "Pending status" on all sites' "Devices" list. You jut need to choose the correct site on the controller page, and then adopt it.