I'd just warn that most domain forwarding ends up returning a 301 response code anyway, and some return a 302. You could always test it out to see what happens. I checked (non-masked) domain forwarding on two hosts and found 301s in the header in both cases. I believe this is fairly common.
One controversial solution might be a JavaScript redirect that search engines can't understand instead. It's obviously cloaking if the content is different, but maybe not if the content is similar. See https://support.google.com/webmasters/answer/2721217?hl=en&ref_topic=2371375
Unfortunately, there's not a redirect method that would prevent both versions of the site from being indexed. Even with a penalty, the old site could out-rank the new one for branded and long-tail traffic.
Perhaps the best/safest option is to simply noindex/nofollow the pages, then show a warning with a link to the new version of the page. Yes, it requires a new click from users, but it's simple enough that there's little to worry about.