The way it have worked well for us is to give them a VM image (ovf) as a blackbox. Look at github enterprise for example.

Edit

Regarding protecting your code do it legally first by contract, then look at code obfuscation tools for python.