Hi Rebecca! This is 100% possible. First, you'll need to make sure you add the agency's IP range to your IP Allowlist in System>Customer Info>IP Allowlist. Then add their users.
Also, I would set up a separate restricted access level and team just for their users that only allows them to load the ...