Give the vendor a container, not a VPN

The monitoring vendor needs to run their collector inside your environment. The old answer was a VPN account, which meant a stranger's laptop on your subnet.

The new answer is a container. Their collector runs there; they get a terminal URL gated by an IP group for their office range. Inside, the container can reach the public internet and the two service URLs you hand it. It cannot reach your private ranges: those are blocked at the host for every container. It cannot see your other containers: no shared bridge, no shared filesystem, no shared process table.

When the contract ends you delete one container. No VPN cert to revoke, no firewall rule to find, no account to disable in three systems.

The vendor gets a computer in your building with the doors welded shut.