Customer machines are usually considered "unmanaged" by your IT, so you would want them to have access only to a limited set of resources they absolutely need to reach. To do that, you would indeed implement a DMZ, i.e. a network zone for which inbound and outbound traffic are limited to an approved list of flows.
That in turn requires a firewall-like device, though that may not always be enough, from a security perspective. In my environment, we do not provide direct access from an unmanaged device to any platforms, even if the devices are in a DMZ. The DMZ typically allows access to a Citrix farm or jump server of some sort, which then allows the users to do whatever they are supposed to be doing.
I would seriously reconsider any architecture requiring a third-party device to have layer 2 access to anything on your network, or vice versa, because you essentially give up on any control you might have between the two (yes, you could force the traffic through a transparent firewall or IPS, but it's going to be messy).