One company we have to deal with created a table valued function that we can call directly from their SQL Server. The only permission we have in their server is to that one table valued function, which gives them the level of security and control they need.