I talk a little about the remote join hint here, people can speculate but if they can't reproduce it's pretty tough to give you an answer.
In the meantime, you can use sp_executesql in a slightly different way to take away SQL Server's choices between bringing any data between the servers:
N'UPDATE [dbo].[Customers] ...
Yes, but you'll need to have them install a Self-Hosted Integration Runtime for the Data Factory is going to access their on-prem server. See eg: https://github.com/MicrosoftDocs/azure-docs/issues/50845
But if it's your data factory and their SQL Server on-prem, that might be a hard sell. Another option is for them to use their own resources (Data Factory, ...
Yes, you can create a Linked Service in ADF that uses Windows Authentication. A Linked Service can be thought of as similar to a connection manager in SSIS.
You may then need to work out security and networking access, but as it stands, conceptually, you can use ADF to access on-prem SQL Servers using Windows Authentication.