Hi Rebecca! This is 100% possible. First, you'll need to make sure you add the agency's IP range to your IP Allowlist in System>Customer Info>IP Allowlist. Then add their users.
Also, I would set up a separate restricted access level and team just for their users that only allows them to load the proofs and prevents them from roaming around your instance. We do this very regularly. If you need pointers, let me know!