A hybrid approach seems sensible: the OSM data contains a vetted/known URL for your business, then your client uses that URL to fetch the hours from the website

A hybrid approach seems sensible: the OSM data contains a vetted/known URL for your business, then your client uses that URL to fetch the hours from the website. In a perfect world, anyway.