Most traditional ISPs use links that are inherently point-to-point (dial/T1/DS3/ATM); the current trend is an ethernet handoff to a router at the customer's location using static routes and a /30 subnet as an interconnect. For a MTU application like yours, you could do VLAN-per-customer using just about any VLAN-capable switch, although there are issues scaling that past 4000 users (you need to split into multiple VLAN universes across multiple routers, or do Q-in-Q). This is the only standards-compliant solution which addresses both of your issues.
Some switches also support client isolation (private vlan/general mode), although this by itself just prevents the offender's immediate neighbors from noticing a problem -- the typical application protects from edge ports transmitting to ports that aren't the switches uplink. Conflicts may still be possible between edge ports on different switches with a trunk port between them.
Fancier switches support DHCP snooping/filtering (and the IPv6 variant, ra-guard) as well as some IP spoofing protections, which can get most of the benefit of VLAN isolation without the use of extra IP space, but they frequently have vendor-specific quirks.
