SSL for SaaS and apex proxy

Our dev team is testing a custom hostnames feature for our SAAS project.

Business goal:
We have a site builder and our clients need to use their custom domains and https.
Could you please confirm that our understanding is correct and help us with several questions below.

We made some changes:

  1. On our domain provider we changed NS servers to use the Cloudflare servers

  2. In the Cloudflare we added:

  3. CNAME to our origin server

  4. CNAME fallback.ourdomain.com to our origin server

  5. CNAME customer.ourdomain.com to our fallback.ourdomain.com

  6. For the client domain page.customer1.site on our domain provider we added:

  7. CNAME page.customer1.site to customer1.ourdomain.com

Looks like it works as expected but there are several questions:

  1. Is it a correct approach or we missed anything important?
  2. Is it possible to use apex domain for our clients like just customer1.site instead of page.customer1.site?
  3. Do we need to use custom DNS to simplify the process? Clients just should change their NS servers to our custom NS?