are they paying actual money to buy these testnet coins? if yes then it is a scam.
if no (which i'm guessing is the case here) then how come the money they pay (or whatever they use to buy) doesn't exist and is fake but the coins they receive has to be real?

besides there could be an easier way of doing this that takes a little more effort. which would be creating a new regtest per customer that wants to test the system, making the connection between the client and server and sync (it is syncing the couple of tiny blocks mined instantly) then sending them regtest coins in any amount they wish.
no matter how much testnet coins you receive, it could be gone in a single test (a user buying all) or a handful of them if you put a limit which would defeat the purpose IMO.