Yes, you can have two non-related beneficiaries.
At this point, only the customers know on whose behalf the cash was withdrawn, you have to file based on your understanding. So if you understand that Friend acted entirely on behalf of Customer, you would indicate that, if you understand that this transaction was entirely for the benefit of Friend you'd file on that (no CTR required in this case), and if you believe that the withdrawal was on behalf of both of them, you'd file it as you indicated.
As for the question of who's to say what really happened, the bank is required to complete the CTR and report who the transactions are on behalf of, and sometimes that requires additional questioning of the customer. If the customer lies, there isn't much you can do, but if you believe that maybe a SAR is warranted and maybe these types of transactions shouldn't be allowed.
See No. 2 in the ancient FIN-1989-R005 for guidance that instructs more questioning with certain transactions.
https://www.fincen.gov/resources/st...s/formerly-known-89-5-how-does-financial