Making REST API available to a third party

Content

We have a need for a third party - e.g. a printing company - to update OSvC with a status when they have fulfilled an item. I am keen to hear others advice on whether it is advisable to allow a third party access to update a custom object via the REST API (by creating a user account with API permission) and/or what approaches (if any) there are to security and being able to restrict what information can be updated.

Thanks,

David