Hi,
I guess the real question here is what do you mean by "They want to manage their endpoints themselves..."
A: If they just want to be able to log in to the AMP portal and manage deployments, policies, look events, etc.. you can just create Admin Accounts for those individuals for that specific child ORG. Those users will still need to create SXSO accounts https://sign-on.security.cisco.com/ with their real email address that will be used to create account in AMP console. To prevent any integrity issue please make sure those emails ale created using all lower case letters, both in AMP and SXSO. You as MSSP will be still responsible for licensing and billing for the tenant.
B: If they wanted to be on their own and buy their own license in which case I believe new ORG will have to be provisioned, and if that's the case then NEW ORG = NEW GUID = New Deployment. In other words all connector in that customer ORG will have to be removed and re-deployed with new connector that will be downloaded and associated with the new ORG UUID.
Unfortunately I do not know all the licensing details and if there is a way to de-couple a tenant from MSSP with out need to create new ORG, that will be good question for provisioning team to confirm this scenario. So I would recommend to contact them as they will give you the ultimate answers if scenario B: is desired.
Hope that helps.
-Roman
