Do I need to grant access to the whole MCC or is a single account enough?

You can absolutely connect a single account, and for a nervous client that's the right answer. The difference is scope, not capability. Connect one account and you get everything for that account - same data, same actions. Connect at manager level and you get to choose which sub-accounts to bring in, which mainly saves you doing the connection thirty times. The only thing a single account costs you is any view that spans accounts, because there is nothing to span. If this client is only ever going to look at their own numbers, that costs them precisely nothing. You can also start with the one account and connect at manager level later if the relationship changes. Nothing has to be decided up front.