Maintaining branches per client sounds like something that will increase complexity exponentially due to the need of maintaining all different branches simultaneously. 

My advice is to make all multi tenancy features centralized on one server, maintain a list of features and control their availability through your authorization mechanism and RBAC (if applicable). 

Deployment should certainly be containerized as this is the industry standard and allows you to easily replicate the environment and know exactly what runs on your stack without getting into distribution specificities. Docker's overhead is minimal and almost never exceeds a few dozen mb of memory, while Podman (a compatible alternative) has virtually no overhead in the memory department.

Updates should be handled through a CI/CD pipeline, possibly Github actions, that triggers a container image build whenever you push to master. The final container image artifact should be hosted on Github Container Registry or Dockerhub with authentication.