Create limited access via FTP, CMS, or hosting panel. Assign appropriate roles, avoid sharing root credentials, and revoke access after work is done. Use version control and dоcument all changes securely.

Exactly give them only what they need (FTP or database access), never full billing or admin access. Once the work is done, revoke or reset the credentials so you retain control.