There are arrestor packages "listed for use as service equipment," but I'd be sure that the utility will buy into your plan before you show up at a customer’s site with heavy cardboard box in hand. Taps should ideally be installed downstream of the metering but before the servce disconnect. [That may involve breaking a seal, so keep the utility in the loop. It’s a bit embarrassing to have a customer without a day’s worth of power while a dispute is going on.]
It’s crucial to keep the tap conductors as short as possible. The arrestor guys may promise the world, but understand that those numbers can be made instantly worthless because they are based on tests at the arrestor terminals,
and surge ratings will always be lower/slower at the other end of the tap.
This text and links are intended ONLY as an example. GE just seems to explain the problem fairly well. They differentiate the connection as “Tee-” versus “Series-connected.” http://www.geindustrial.com/products/applications/choose.pdf http://www.geindustrial.com/products/brochures/9l10f.pdf
GE hawks a true Kelvin-connected series, but they’re limited to a 100-ampere-continuous circuit rating. http://www.geindustrial.com/products/brochures/9l10m.pdf
The only time these comments would not apply is where a equipment company insisted on some blind installation of a ‘showpiece’ arrester to fulfill some mealymouthed insurance or warrantee clause, with no real concern that it had to work properly. That’s where the little blobs with a locknut and three-foot leads prove useful. (Too many arrestor salesguys proudly list Durro-Test in their resumes.)
Regional variations and local customs will determine how this applies to you.