Question about External Anti-Phishing Vendor Requesting Edits to Anti-Spam Policies and Adding Domains/IPs in Microsoft 365 Defender

I recently engaged an external vendor for an anti-phishing campaign, and they have requested us to edit our anti-spam policies in Microsoft 365 Defender. Additionally, they've asked us to add a list of domains and IPs to the policies to allow certain phishing emails through. While I understand the importance of a collaborative approach to security, I'm a bit concerned about not having full visibility into how these domains will be used beyond the security engagement.

Have you engaged an external vendor for an anti-phishing campaign? Were you also required to add a list of domains and IPs to allow certain phishing emails through? How did you approach this situation, and were there any specific measures you took to ensure the security of your organization's data?

I'd greatly appreciate any insights, tips, or best practices you can share on this matter. I want to make sure we're taking all the necessary steps to protect our organization.

Thank you in advance for your help!