Why not having one organization per client. We try to avoid multiple organizations, but your use case is a perfect match for that. If all client's repositories have to share code from your repo, simply create your organization, transfer shared repositories to it, allow everybody from your enterprise (or you don't have github enterprise license ? ).

This way, you're able to install a AWS Github Connexion App on each organization with client specific authentication.