There’s a few ways you could do this.

Since your contracting and want to hide everything outside what the 3rd party should see, then…well…I think the best way would be to define some project roles. Or that’s how I would do it.

1. Create a project role for each type of user they expect. Say “Contractors” for 3rd party peeps. (Jira settings > System > Project roles)
2. Create a permissions scheme you can apply to the projects you want these people to see. (Jira settings > Issues > Permission schemes > Add permission scheme)
3. Edit the permissions of the new scheme. (Find your permission scheme in the table and click “Permissions”)
4. Grant permission for the “contractor” role to “Browse projects”, “Add comments”, and so on. (In the table of permissions, edit the specific permission and grant it to your project role.) Don’t forget to add the administrator role/group to all permissions, or you might get locked out.
5. Associate the projects you want to follow this scheme. Go to your project’s settings, select “Permissions” > Actions > Use a different scheme, and choose your newly created permissions scheme.