How do I make sure outside vendors only have the access they actually need?

Give vendors named, limited accounts tied to the specific service they provide. Avoid permanent administrator access, set expiration or review dates, use MFA, and remove access when the work or contract ends.