It seems that the easiest option is to remove all the document types except for index.htm (for example)
Make this file so it cannot be replaced and that their FTP user does not have any rights to it.
Then add a frame on this where you want their home page to appear. You can tell them to use home.htm only.
It then loads their site up in the frame.
However, this isnt a great example because they could just redirect to home.htm and all pages wouldnt have a banner... just the home page.
The better way would probably use mod_rewrite (available as a download) and a .htaccess file and tell it to redirect all traffic to a page with the banners and filter out images and such so that everything doesnt get a banner on the page.
How you do that is another story

I am not familer with PHP. Have a search around and see if there are any examples of code. I am sure someone has a free sample of code you could use in IIS.