Create a security group with constrained one and add the organization you want to restrict in the security group. Share the ISU to external vendor with the attached constrained security group.