As a security researcher that normally breaks secure systems that's quite an interesting question. You basically want DRM on a system that someone is in physical possession of. You have to let your client read the data and by the nature of doing so give them a vector to copy it.
For the vast majority of end users you can glue in a Yubikey with a decryption password for the SD card. That gives you an avenue for updates. As for potting or using epoxy on the RAM, if someone of that skill is trying to copy your data you're not going to stop them with a bit of epoxy or glue. You can put it in an armored box completely potted except for heat pipes for the chips and someone will still defeat those measures if they're determined.
So for the practical advice, use the Yubikey to boot that's glued in and have a lawyer draw up a nice NDA with provisions for reverse engineering and removing data outside of it's defined use. There's nothing like legal liability that will stop many companies in their tracks. If someone is going to covertly do it and they have the skill to extract data from chips and data busses, they'll do it anyway. The lowest hanging fruit is just to expose and tap the serial data on the USB bus to snag the key. The other is to just scrape the webserver with scripts.
I'd host the device in my control and use 2 factor authentication with a token I give them to gain access over the net. Then at least you can monitor logs for activity that indicates web scraping.