How to handle vendor remote access?

Context:

We own two different retail chains and both use different security companies. We have "security servers" (just PC's) running the cameras, door locks, etc. at each site and both security vendors want "24/7 unattended access" enabled to better support. Specifically they want to throw on TeamViewer unattended and want a local admin account spun up (currently these are Azure AD joined with no local admins) so they can login whenever and help our security guy.

We only have 1 security guy that is NOT a domain admin so often he puts in requests to these vendors to help with footage requests, issues with cameras, blah blah. I DO have anything SECURITY based on its own VLAN, no DHCP turned on, I have some policies that say certain computers can talk to that VLAN (to view the cams) but networking wise its on its own island and doesn't touch much.

These are what I would call "trusted vendors" meaning we work with them hell of a lot and have a good relationship and I don't think they would do anything malicious.. Here is what I am currently thinking for a solution:

- Spin up VPN account for each security vendor duder that needs access so we can track better + give access to only SECURITY VLAN

- I guess enable RDP and create a local user (NOT ADMIN) so they can login and then they are going to have to call IT if any UAC prompts pop off I guess?

- Remember to log out..

I guess what I am looking for is:

A.) Any other solutions yall can think of?

B.) Should we just "escort" each login?

C.) Validation I'm not crazy by just giving them free access :)