We do have a policy for 3rd party server access. We disallow it, unless they own the hardware and we have it isolated to its own network segment. The policy actually reads:
"No third party shall access any [company] owned server resources without an IT representative facilitating the connection."
The procedure is a little more complicated. We typically set up a remote (Webex) session and transfer control so that they can access the system, and IT staff can monitor as needed. It's too hard to even keep tabs on what the IT staff has done when problems arise to allow an external vendor to meddle in the systems without 1:1 supervision. It also gives our team the ability to question any bizarre compromises that the 3rd parties make to install additional apps, disable the AV or monitoring, or worse.
Round that out with a tripwire or configuration management tool like Ecora Auditor (what we use for Tier 1 systems), and you should be in very good shape. This gives us a periodic delta file of what has changed across a huge cross-section of configurations on servers.