Hi, this requirement is a bit confusing.

If the client does not want the instance cloned, then that indicates they do not want the instance copied. As far as security goes any options that are not clone based will be less secure as the data will flow through an environment external to the vendor data centre.

Perhaps someone needs to explain cloning and table exclusion to them properly?

They could also log a support request for SNC to restore a backup to a dev instance, which would be no different to cloning but may make them less paranoid.