Where are you based?
That may have a small impact on the interpretation in terms of the strictly regulatory definition of what the last "manufacturing location" is, but in general I have to say that I agree with your customer's interpretation here - it may be the case that I've spent so many years dealing with UK retailers who want to know the inside leg measurements of our supplier's supplier's cousin's third wife's dog, but the BRC standard is fairly clear on this IMO:
Where materials (including primary packaging) are purchased from companies that are not the manufacturer, packer, or consolidator (e.g. purchased from an agent, broker, or wholesaler), the site shall know the identity of the last manufacturer or packer, or for bulk commodity products the consolidation place of the raw material.
In this case it sounds like your business is neither the manufacturer nor the packer. Your FSSC22000 certification would of course satisfy the requirements for BRC and allow you to "protect" your supplier identities if you were actually making the product (although wouldn't necessarily satisfy the growing requirements for transparency across multiple layers of the supply chain that seem to be becoming ever more common at least in western Europe), but here it seems you're more akin to a distributor that does metal detection as an extra check?