Is it important that your clients do not accidentally edit the vault you send them, or do you require that vault to be secure from edits, because there’s a sizable difference between those two ideas. A requirement of absolute offline security could push Obsidian right out of the scope of what you’re trying to accomplish, depending on how far down that rabbit hole the developers are willing to go.
The Viewer idea is neat, but one would have to conjure up an incentive to build and maintain another piece of software. Obsidian is supposed to be free, with a business model built around optional online services.
Maybe the most effective strategy right now is to wait. Once Publish is allowed to mature, the addition of a few often-talked about features could change your perspective of the problem. Custom domain names, custom style sheets, password protected online vaults - with those you could conceivably host read-only client vaults at your own business domain. It breaks the requirement of offline-only, but it’s elegant, and far more likely to already be on the roadmap somewhere. Is the offline-only thing a hard rule?