Can my clients buy plans and add-ons themselves, and how do I hide a plan from them?

Yes. Clients can upgrade or add plans and add-ons to their own account by going to Settings, then Billing, where they see the plans and add-ons available to them.

A plan or add-on only appears there if it is visible to clients. In the SaaS Configurator, under SaaS Plans, each plan has an option to hide it from customers. When that switch is on, only you can see the plan. It is off by default, so clients can see the plan and purchase it themselves.