Yes, we definitely give them full access to their site. Even super admin if they're on a multisite install. But we also tell them about risks of suddenly updating anything outside of our process. It's their site. They should have full access.