what do you mean by not openly public? Any web address is open to the public and vulnerable to an attack or hack.
So lets see then, This client obviously wants to be able to create customer accounts with a password assigned to various folders or photos, . When the customer has logged on they are then presented with their own portfolio of photos, and you want to do all this without the use of PHP and Mysql. Oh dear.
just how are you expecting the client to create new accounts and passwords? Have him modify htaccess and mess around creating new folders and password protecting them? Thats not worth £900 to be honest, £9 solution maybe.
If you going to rip him off then your best bet is to rip him off by just installing a CMS
__________________