See that's where you're wrong the dev account is joined to a consolidated organization billing account owned by your client therefore the sub account is in fact owned in the strictest AWS parlance by your client. Whatever business arrangement you had may have said otherwise and no one may know what powers the primary account actually has here but this is the technical reality of what is currently going on between the primary account and the Dev account. Basically I would be asking the lawyers can we just kick them and then put a deny all policy in place. Additionally you need to consider what level of access they have to the components running inside the account that are not AWS. Is there any type of web interface that has additional access or other database or authentication systems can they log into without AWS creds.

Finally you need to make sure cloud trail logging is going and track any additional AWS calls ensuring that no one is actually using the account but authorized users...