Great topic, not sure you will get a solution here but this topic came up at the last user conference. PTC ran a focus group and these concerns you listed were all brought up. See the pinned message at the top of the board (Participate in Supplier Collaboration Research). This slide was shown:
Things seemed to fall apart when we discussed CMMC, Cyber Security, ITAR as being the major stumbling blocks to integrations.
If you are dealing with individual contracts and designers, they can be vetted and treated like regular employees with appropriate access. I am sure your IT has to have some remote workers who connect over VPN. Sometimes that involves them working on laptops you supply that you control so it shifts the problem of interfacing with that laptop to their end, basically eliminated the untrusted hardware aspect connecting to your network.
I suspect you are dealing with interfacing with an entity or company where the resources assigned are dynamic (many or changing users from their side). Same problem but you might not be dealing with static users on the other end. Creo+ might be out due to what you said about version compatibility.
A virtual machine could work and I've seen it done. Its a bit like operating like this.
Your suppliers would still need to VPN in and connect to a VDI (graphics session) of a VM operating inside your network or DMZ. You need to make sure your network can support this (latency can be a killer) and its optimized for Creo (single threaded processes). We did see lag when spinning and typing characters but those were solved so that it was near same as running locally even though the user was in another state. The issue then becomes getting files into and out of that sandbox. In this setup, you want to make sure nothing leaves that is sensitive. So you still need some dropbox style portal to ferry data back and forth to the supplier. Ideally, there would be no need for transfer, that anything created or viewed stayed within your systems. That never happens though.
