Completely disabling password reset/recovery

Since this is a multisite you’ll have to put the disable password filter in a mu-plugin. Create a file in wp-content/mu-plugins with:

<?php

add_filter( 'allow_password_reset', '__return_false' );

That should completely disable password recovery. It will affect all sites, not just that one customer’s: if that’s not what you intended you’ll have to add logic here to restrict it to that one user e.g. by name, or by checking for permissions / roles on that customer’s site, or by a flag in user meta.