Drupal 8 master site for managing customer Drupal 8 sites? Possible?
It sounds very much like you'll need two solutions. For sharing the code and parts of the configuration a distribution/install_profile makes sense (https://www.drupal.org/docs/8/creating-distributions). When you make changes to the distribution you'll need to write hook_update_N functions to make these changes on the sites that are using it. So updating a customer site becomes the number problem of deploying coding and running update.php (or doing a cli command).

With respect to sharing roles and users this I might look to do something different. Maybe integrate with a third party identity services that allows you to share the identities across your sites. The roles can be deployed as configuration as part of the install profile. Buried somewhere in this presentation https://events.drupal.org/dublin2016/sessions/no-compromises-%E2%80%93-react-relay-and-graphql-drupal-8 is something about integrating Drupal 8 with an identify provider. And there's also things like https://www.drupal.org/project/openid_connect