The relevant portion of the GPLv3 license, in layman's terms, is as follows :
In purely private (or internal) use —with no sales and no distribution— the software code may be modified and parts reused without requiring the source code to be released. For sales or distribution, the entire source code need to be made available to end users, including any code changes and additions— in that case, copyleft is applied to ensure that end users retain the freedoms defined above.
This clause generally means that those using NodeBB for their own private use are not required to disclose the source code, while those who are generating sales from the product (or a derived version) would be obligated to include the source or provide it upon request.
It is a bit of a legal grey area. On the one hand, since you are creating a (possibly modified) NodeBB for a client, this would constitute a sale, and the source would be required to stay open.
However, if you are not planning to distribute further copies of that derivative of NodeBB, then it would be no different from had I created the NodeBB myself for your client, in which case it is a matter of personal usage.
USE of a NodeBB is allowed under the GPLv3, at any price.
Keep in mind I am not a lawyer. You would be wise to look for a second opinion on the matter