PS. Am I understanding it right that the only way to play music on a site in a way that the user cannot download it is to embed it into the page (using a script) so that it plays when the page opens)?
Ugh. There's nothing more annoying than audio that starts when you open a page, especially if there's no way to quickly shut it off. In your client's case, a visitor may
expect the music to start playing when they go to a specific page, so it wouldn't be so bad (or unexpected). However, as @scanman20 pointed out, it does nothing for security.
You might look into "streaming" audio, where the entire thing is not downloaded at one time. If someone wants to put in enough effort, they will be able to capture the entire piece of music with a special hacked player, but it will probably be a lot tougher.