An Azure service that is used to control and help secure email, documents, and sensitive data that are shared outside the company.
Using service accounts is not recommended as you know. The vendor should be using a service principal ( enterprise application) to access mailboxes, not an actual account.
If that is not possible, then consider using a conditional access policy if you are licensed (Premium P1) and scope that user to only allow logons from trusted IPs ( whatever those IPs are)