It sounds like Qualys is probably your preferred option: ongoing and repeated vulnerability scanning provides a long-term security blanket which will comfort your customers.
That being said, you should understand the difference between vulnerability scanning and a targeted security audit (often "pentest").
Vulnerability scanning will make sure that your infrastructure is, and stays, secure. It will detect when you the web server software you're using suddenly becomes vulnerable because someone released a new attack against it. It will detect if your server starts offering FTP to the world. It will notice if certain known vulnerable configurations of the web server show up. What it won't do is provide any real insight into the security of your application.
That's what a pentest does. The pentester will look at your application with experienced eyes and specialized tools, and try to discover if you made mistakes when you wrote the application that an attacker could capitalize upon. They'll also look at the same sort of "vulnerability scan" things, but the real value-add is to have a human think things through. People can make connections that computers can't, recognize patterns that indicate subtle problems.
So in an ideal world, you'd have your application pentested at the start, and again whenever you make major code changes to it. And you'd also have Qualys (or an equivalent, of course) run regular vulnerability scans to look out for all the simple, straightforward stuff that regularly bites people in the posterior.
If you're just checking a checkbox, though, that's more money and effort than you're looking to spend. Go with the regular vulnerability scanning, you'll get the seal of approval to show people and you'll get helpful defense against the "low hanging fruit" - easy for attackers to find, usually easy to fix.