Disable Plugin Updates but Allow WP Auto Security Updates

To answer your question directly, you can use the file_mod_allowed filter to override the DISALLOW_FILE_MODS setting for the automatic updates only. Here is an example of how to do it:

add_filter('file_mod_allowed', 'override_file_mod_allowed', 10, 2);

function override_file_mod_allowed($setting, $context){
    if ($context == 'automatic_updater'){
        return true;
    } 
    return $setting;
}

The second option, as someone suggested to me in the WordPress IRC channel, is to give the client an editor user role rather than an admin, as this seems to be closer to their needs.