If you are going to secure many subdomains / hostnames on a single domain then you probably need what is known as a wildcard certificate.  This may be overkill though.  You could just get one certificate for "secure.customerdomain.com" and make sure that all secure traffic is handled through that.  Keep in mind though, if you are going to secure the input on login, then you will need to secure the actuall hostname.domainname they will be logging into, otherwise the user will not be logged in when they move back to a different hostname.  In that case, you are back to using a wildcard cert if you want to secure several hostnames / subdomains.

Yes, creating a menu item that points directly to the SSL channel would be a good way to switch on. You may also need a way to switch SSL back off if they go to non-secure pages though, and the Enforce SSL setting in admin > Site Settings should take care of that.

If you have several pages that should be secured using the same alias (host.domain) then you may want to make use of the SSL Url under Admin > Site Settings. I haven't don't extensive testing of this setting, but that is my understanding of how it is supposed to work.