Sorry, I just seem to be getting confused between the host and vm and what is where. Think I have it now though!
If your second physical network port on you esx host is plugged in to the other network (200), does the customer need access to your host?
If not and it is just the virtual machine he needs access to then you don't need to create a vmkernel port group on the second vSwitch just create a vm network on it. Then make sure your virtual machine has to vNics attached. The select one in the vswitch0 vmnetwork port group (100) and one in the vmnetwork portgroup on vSwitch1 (200).
Even in the way I said to set up a new management port group in my previous post, or this one, I can't see your actuall esx host becoming inaccessible.
Dan