I find that the following image from Wikipedia, though too perhaps a bit too technical for your purposes, is still helpful with a little explanation:
Essentially, a function $f$ is used repeatedly in two phases, absorbing and squeezing.
In the absorbing phase, small chunks of the input data are mixed into the beginning of the buffer using XORs (using the variables from the image, $r \oplus P_i$). This updated buffer value is then passed through $f$ and the process continues. With each step a small amount of input date (the bit-length of $r$) is "absorbed" into the buffer using $f$ to semi-randomize the entire buffer.
In the squeezing phase, the same process is repeated but instead of XOR-ing the first $r$ bits with data, they are extracted as the next $r$ bits of the output.
tl;dr: The input is mixed into a buffer in small chucks in between phases where a buffer is randomized, then the buffer is randomized repeatedly while small chucks of it are taken as output.
It feels worth calling out that your purposes for recommending SHA-3 over SHA-2 may be more important. Does their application of SHA-2 suffer from the possibility of length-extension attacks? Are there other benefits of SHA-3 that you could benefit from? As mentioned here the situation isn't really "move to SHA-3 because it's a better version of SHA-2."
It's possible you're already aware of this but you client may not be. As such, a simple description of how it works may not really be all they need, even if that's all they're asking for.