So, let's see if I'm understanding this:
- You are making an app for someone else. We'll call you the 'developer'.
- Your customer is paying you to build that app. We'll call them the 'publisher'.
- The publisher will not be selling to the public, they will instead be installing the app on devices, configuring them and then selling the entire solution (i.e. device and pre-installed app) to their customers (we'll call them 'end users').
Yes? And since one of the publisher's potential end users is Apple, you have a heightened sense of compliance with the rules (which you should be doing anyway).
So in this case, the publisher distributes the app via the B2B model and makes themselves the party it is allowed to be sold to, restricting the availability to those devices. This will require the publisher to create an Apple ID to manage their VPP participation.
Now, that's assuming the end users aren't going to be using these iPads for other functions. If they are, then you'd need to allow those users direct access and perhaps re-figure the business model a bit. That would also allow the end-users to re-install the app if they needed to, etc...
This PDF described the process in more detail: http://images.apple.com/business/docs/vpp_business_guide_en_20130413.pdf