We had one of our customers find their way to our sandbox SuiteCommerce site and using their login, try to make a payment on an invoice... When I check access on the customer records, it does not show that the customer or any contacts have access, but it shows that they did log in today. Do I need to check and uncheck access for every contact/customer in SB to remove their access ability from the sandbox SC site?

This is a known bug in NetS ... I don't know if when they are going to fix this.