Yes you can assign secondaries for each /30 and would need to if you were going to segment your customers as you mentioned. They would need their own default GW as well but some in small installs like to use Proxy Arp to avoid this. ... as you can imagine this gets ugly. Possibly a bigger subnet if security is not a concern. If the clients are coming into the same unmanaged (assuming this is not capable of VLANs) switch then creating a bunch of different networks might be a mute point since all the clients are already on the same L2 and need not pass through a router to get to devices off that switch if they can manipulate their IP/Mask.
DHCP makes addressing very nice, especially when you need to change something.
Best way to do this, in my opinion, is to get a router/switch that is capable of VLAN segmentation. Put customers in one or mulitple VLANs and your devices in another. This would not allow these customers to access your "protected" equipment without going through your router (either trunk sub-interface or separate interface) where you can implement whatever security/QOS/redirection/etc you want.
There are a zillion different ways to do this depending on specifics of architecture, budget, PIX location/interfaces, etc. I hope this helps you out some.
Regards,
Don
