As a security professional, I disagree that
It's not to do with security
You are trying to prevent sensitive information from leaving its intended context (the web browser). By definition, this is an information security issue and should be treated as such.
Putting on my security hat, let's frame this as a security problem.
Asset to protect: content of the web pages.
Threat model: user extracting the data from the browser, perhaps to a file on disk.
Mitigation: disable copy&paste.
But does that really mitigate the threat? The usual rule-of-thumb for this is that if a user has read access in one context, then they copy the information into a different context - almost regardless of what type of read access or what type of context. For example, if they can load the web page, then they can write a script to fetch all pages and dump them to a file.
In practice the game of restricting the copy of information is a spectrum, from weakest security model to strongest:
- Free to make digital copies.
- Digital copies are possible, but tricky to do.
- Digital copies restricted (usually because it's a non-internet closed network), but cell phone photos can be taken of the screen.
- Cell phones are not permitted in the building, but pencil&paper copies can be made.
- Paper is not permitted to leave the building, employees are searched on their way out. You better have a good memory.
Basically this is a game of making the information harder to acquire than it's worth - a deterrent at best. At some point it's more cost-effective to do extra screening on who's allowed to access the information and rely on good ol' fashion trust & loyalty.
Bottom line: disabling copy&paste raises the bar for copying the information, but certainly does not prevent it. Your client needs to view this as a security issue, and apply a security mindset. IMO disabling copy&paste is one of those security theatre things that management can feel smug about, causes a great deal of inconvenience to users, yet does absolutely nothing to prevent skilled hackers.
There's also a running joke over at security.stackexchange called AviD's law of security:
Security at the expense of usability comes at the expense of security.
since users who find your security too onerous will always find dumb workarounds.