User agent and other headers can be used to provide more differentiation, but you're correct to point out that limitation (assuming you meant IP not ISP).
No, I meant ISP, although IP could work as a special case - if this isn't recording the user's actual IP but just information derived from it (rough location, residential/commercial/datacenter, whatever), I would expect many addresses under that ISP to have the same recorded details. Granted, CGNAT with the same exact public IP would be even more like that, but if you don't record the actual IP then you probably can't deduplicate close "neighbors".
(I should add that your sibling comment says they're using browser headers, which probably reduces this issue a lot)