#1 - every client gets their own VM. Unless it acts badly on my network, I'll install pretty much any requirement they ask me to on that VM.

#2 - if they require something specific in terms of hardware ("install this spyware directly on bare metal"), have the discussion about hardware setup cost/time and then expense them for the hardware you have to purchase.