What's the best way to protect against this?

We’re implementing our code as open source (AGPL3) and offering entirely self hosted, cloud hosted by us, or third party hosted options.

Our biggest customer wants to pay us to cloud host it for them and manage the whole thing.