Sounds like you might be needing to evaluate the use of private vlans, or the capability that Cisco ACI provides with different EPGs and contracts that can use the same vlans, but give you granular control over the specific hosts that can communicate with each other.
On highest platform you can perform vlan translate. I don't see this option for N3k. I have a solution, not the most beautiful, but will work in your case. You told the connection with your customer is a access port. You can use any vlan on nexus. Access port have no tag, unless you configure it. More information below. The cdp will complain about this, because native vlan will mismatch.
