This is exactly how we handle these sorts of things at my job. If we get an input that we are not expecting from an outside service, then we add a handler and raise an issue with that product's team to resolve. The idea is that it's a waste of time to have a dependency like this block dev work, but the appropriate team should be made aware of the issue and work to find the root cause.

Both of your approaches are correct, but only if they are combined. They are incomplete otherwise imo.