This shouldn't be a "coding" issues, as in programming within a users site. This is a standard .htaccess file edit;
RewriteCond %{REMOTE_HOST} !^123\.456\.789 (this is the IP number of the client)
RewriteCond %{REQUEST_URI} !^/maintenance.html
RewriteCond %{REQUEST_URI} /(.*)$
RewriteRule (.*) /maintenance.html [R=301,L]
So basically what you've done is redirected anyone who access the site to the file name "maintenance.html" which is a file that you would create to let people know that there's an issue with the site. The FIRST line says that if the IP number matches that number, then bypass the rules and just show whatever page is being requested.
Believe me, your clients will appreciate that you took the time to make this edit rather than just suspend them and block all access to their mail, control panel, databases etc, and pretty much held them hostage until you decide to make a backup file and release them.