All they are doing is demonstrating that they can do so from your terminals in your controlled environment. Does your management 'reasonably' believe and expect your customers to come into the branch and access their online banking only during your business hours? No, you need to be able to have them demonstrate that they can access their online banking from sources they wish outside of your banking environment.
Your management is partially correct that they may be on some random public computer and that is fine, but it should be outside of your bank's control (times, access, current required technology in place).
Follow-up question for you and your management: can any of you off the top of your head verify and prove away from your normal standard terminal access, that you in fact have met all of the system requirements, without having access to the system environment you will use? Doubtful.
_________________________
I don't repeat gossip, so listen closely...