Greeting:

We have been on a project for a client with a low budget and we want to roll out existing and free salesforce features to accomodate with one of the requirements.

The client would like to expose their change management app to each and every one of their customers, and allow them to create and update records in their (our client) system.

The client would prefer not to rollout customer community.
We are to leverage either Force.com Sites or Site.com Sites (force.com is our first choice for site.com with require external Domain or active Community) to achieve this.

At this point, I would like to specify this to my first force.com/site.com implementation and would like inputs/recommendations.

Request: How does one restrict public access to a Force.com Site and only allows selective users?

Fact the client's org is new (therefore portals are not feature options)
Assume IP restriction will not apply as a security layer.
Assume Customer data is sensitive and can only be viewed by customers and each customer can only view their own data. 

Can the above request be satisfied at low cost with a combinaiton free features or licenced features or a combination of both?

Thank you all in advance.