We have always operated on selecting the NAICS code associated with the business type that generates the majority of the revenue for the business.
However, in this case we would likely call the customer a used car dealer since that business type in itself is a higher risk business type.
It is also my understanding that NAICS code is not a requirement of due diligence/KYC however, it is widely used among banks to document a customer's business type and assign appropriate risks. Again, I would use the high risk NAICS of used car dealer as the primary NAICS and document in the customer file that they also sell new cars.