As for storage … You get 15GB free, and the site didn’t use much storage. Each page was maybe 1K, and I’m sure you know you can store a whole lot of pics and vids in half a gig. You could even create different accounts to host the sites if you end up using too much.
As for access control … I ran their analytics on the site for a while out of curiosity, and nobody other than the friend group ever accessed it. I’d see a google crawler every now and then, but I saw no evidence it was indexed, probably because there were no meta tags. So basically you’d never find it unless you had the URL. Definitely not foolproof, but likely good enough for this sort of thing.
As for users needing google accounts … We had some sheets embedded in the site, and I do remember that (1) the sheet had to be shared, and (2) users had to be logged in to their google accounts to see them. But I think that was because they were sheets embedded from Drive. The pictures on the site didn’t have this limitation, even if I added them from Google Photos. It seems to replicate those to the site without restrictions. So your clients should be able to see all that with just the URL, without logging into a google account. You can test this by browsing from an incognito window.
Also just in case it wasn’t clear, you can publish multiple sites, each with its own URL for each client, so you’re not mixing pages for one client with another.
Sorry for the long-winded reply. Not trying to push it, just answering your concerns from my experience. It worked great for our purposes and you can’t beat free. 🙂