Comment solution (Score 1) 43
If connected to the internet, wouldn't the below stop 99% of these issues:
Auth1: restrict connections by source IPv4 or IPv6 of the vendor (if vendor managed). The customer could add their own HQ IPv4 or IPv6 source addresses.
Auth2: require a legit client certificate when connecting to them that's signed by the vendor (if vendor managed). The customer could also add their own client cert from their internal CA.
Auth3: require username\password
Only if all 3 auth layers pass can you connect.