From a business perspective, you should be covered by copyright law, in addition to (and underlying) the licensing contracts with your customers. It's certainly a risk, but lots of companies actually open-source their code (or found their business on developing open-source code directly), and many others will share source without licensing it for redistribution. Up to your company if these risks are acceptable; talk to a lawyer about the legal details. I'm not going to say more from this standpoint; it's really outside of the scope of the site.
From a security standpoint, it's true that exposing your source code increases the likelihood of vulnerabilities being found - access to the source is classically one of the defender's advantages over attackers - but that's not all bad. By licensing your code to customers, they will be motivated to report any discovered vulns to you; they'll want you to fix them because they don't want their own data to be at risk. It's also worth remembering that while security research is generally legal, exploiting vulnerabilities (or attempting extortion over them) very much is not; even if the person finding the vulns is totally amoral, the incentive to exploit the vuln needs to be pretty great to overcome the risks of personal legal consequences. Unless the software is really popular, or provides access to very valuable assets, the benefits of exploitation often don't outweigh the risks.
In terms of making it safer, a lot of that will just fall on your company's security posture. How much security review has this product seen already? Have you had professional (internal or external) pentesters perform a thorough review including code analysis? Do you use static analysis tools? Do you have a bug bounty program (publicly, or privately but such that you could invite anybody who reported an issue) to incentivize disclosing vulns to your company? How often do you find vulns internally? How often are they found externally? How quickly can you resolve them? Do you have secrets your app depends on? Do they need to be distributed with the app? Can they be unique per customer? Can they be rotated easily in the case of exposure?
Once you answer all those questions, you'll have a better idea what risk you're taking on. I have seen SaaS products that had bundled or even hardcoded secrets (e.g. credentials to an external email account) that caused a problem when they distributed the app for on-prem deployment. I've seen apps that had obvious security issues - not even the kind of thing you need source code to find - that were immediately pointed out during the demo period. On the other hand, these findings led to improvements that the product and all of its users benefited from. I've also seen companies use access to the app's backend to build useful tools on top of it, expanding the usefulness of the app without the developer needing to implement the functionality themselves.
