In reply to Matt.

That's a simple one Matt. Just don't allow the external companies access to their repositories. I don't think it's "normal" to allow doing that - normally it's the company that wrote the code who retains the IP.

If they really want access just add those costs into an ongoing bill and pass that on to the customer. They'll soon stop asking