Yes, they would have to user either named users or participant users to have them authenticate. Another option would be if the customer built a secure site of their own that their customers could authenticate to and then embed the forms into different pages of that site.