If a client requests access, do we have to show them the entire designated record set?

You should describe the entire set, and ask what parts they want to see. However, you may deny access under very specific circumstances, as set forth in the Manual.