Hi @EnterpriseArchitect ,
I need to restrict the external contractor to access only the specific instance of Azure WordPress on App Service
Assuming you're referring to the app service resource in the subscription, then you would add Website Contributor role access only on the WordPress resource. You can do this through the Access Contorl IAM blade on the resource, select the role, and enter their email.
this external user must not be able to delete the whole resource or see any other resources, apart from the Azure WordPress on App Service object only to upload and manage the content
This to me sounds like being able to upload the content on the WordPress site itself. For that, you would just grant necessary user roles via WordPress management portal; see https://firstsiteguide.com/wordpress-user-roles/.