Provide customers with access to Azure Container Registry
There is a balancing act here between the simplicity and maintainability of your solution, and how auditable creating separate service principals or users for each of your external customers.  I suspect only you can actually decide which is the best practice in your specific legal and regulatory situation.

On the side of having a single Service Principal with multiple passwords, there is a minimal amount of configuration required and other than perhaps limitations imposed by Microsoft on the number of authentications per second or the number of passwords that can be created for a Service Principal it should work quite nicely.  The downside is your resource logs won't give you any information about who pulls images, you will have some logs about issuing a short-lived password, but you can't prove that's related to a docker login.

On the side of creating a Service Principal per client means your resource logs will tell you who pulls images.  However, you will need to automate the creation and maintenance of those Service Principals to account for clients joining and leaving.

Why does it matter? it may not for you, however if one of your customer's machines was compromised and the images leaked onto the internet you may want to hold one of the customers to account.