Most vendors I have worked with offer two options:
1.) Hosted solution
2.) Service API
The hosted solution is normally some type of application that you log into and configure different options for your deployment. Never do they actually grant access to the filesystem or code itself. The entire site is built/configured through a GUI. In some cases there is only an area to paste in a header and footer. Than like you are saying the main content is injected. The level of customization exposed through the GUI can either be real complex or real simple. That would all depend on what needs to be done, etc.
The service API is a gateway to the database. So that if a customer feels they are to limited with the hosted solution can actually pull data and build their own site. This would make it possible for any customer to gain access to all the data without the vendor having to integrate or worry about the customers technology stack. The API itself could either be REST or SOAP option depending on your current stack/familiarities with technologies.
I wouldn't mess around with creating an application that is copied over and over. Instead use a hosted solution that resides on your server that offers a limited amount of options. If the customer feels they are to limited with that than refer them to the service API.
And some vendors… really suck. The terrible ones normally only have some type of text file or RSS feed. Those types of vendors are terrible to integrate with.
I'm not really familiar with Joomla. However, I;m very familiar with Drupal. While something like this would be possible with Drupal it would be difficult. Permissions are really scattered and it is quite difficult to manage three global states of a Drupal site. Especially locking down admin features. Possible but painful. Not to mention how many products/variations are we talking here? One thing Drupal does not do well is scale unless you throw a lot of hard-ware at it and "Drupal" oriented server configuration.
In reality though it seems like the only thing your obligated to do is have some type of API to access data. Providing some type of customizable hosted site for customers seems like a little above and beyond the call of duty. Most customers are probably going to integrate directly with their own technology stack anyway. In which case having an API to pull data out of whatever storage facility you have is the only vital thing. Unless you think it is truly a wholesalers duty to provide customers with a website. I really don't think it is. In more cases than not people will probably already have their own sites or no? The return on investment just seems dim for that piece of it.
As someone who works with a lot of vendors I much rather see a well documented, working service API than anything. We almost always integrate with our technology stack anyway. In fact I'm currently integrating several of our real estate vendors data into our technology stack. Luckily they all use the real estate standard for their services API. Otherwise, I would probably want to shoot myself considering we are talking about 13 separate real estate vendors. Standardization is an amazing thing!
- Could also just go the route of the law enforcement system and just have absolutely nothing besides scraping some god awful broken, stuck in the 90s web page.