SNAT by Destination IP

You'll need an iRule I'd say and a Virtual Server to run it through. The VS will only need to be enabled on the customer network. Apply the SNAT to the VS and also an iRule that simply checks the destination IP (you can check for an egress interface) and if it matches one of the internal networks (perhaps listed in a data group) simply disable the SNAT. If you need help with any of that, let me know.