They simply have to be in separate AWS accounts for this to work. To that end, you can provide them with a CloudFormation template that deploys a stack with the necessary configuration.