Domain Masking (?) and Security

If I have www.mydocs.com where people make & host documents which can be shared with people e.g.

www.mydocs.com/doc1

However, they may want it to look like it’s come from their site, so rather than the above it may be

documents.customsite.com/doc1

I believe this can be achieved with the customer putting in a cname within their DNS ? Is this called domain masking?

My question…

Ultimately the customer wants to make it so their documents are not publically available. If they do the cname/domain masking can they then put security in place to ensure they have to be logged in to documents.customsite.com or because its “redirecting” to my site are they limited in what they can do?

can I block someone from just putting a Cname/domain masking to a site, but still allow the site to be embedded in an iframe?