I just allow access to their application only for their IP address(es) and my deployment server checks if I need to update anything. That's not expensive.