I tried to simulate the situation on two test repositories:
- avn - repository, which is located at the contractor
- fcs - the repository, which is located at the customer company

There are two responsible for integration: one at the customer, one at the contractor.
We believe both repositories are available on the Internet for managers.
Phase 1. Development on the server of the contractor.
Fill in two or three commits to simulate how a contractor works:
touch avn-file1.txt git add avn-file1.txt git commit -m "avn-file1.txt" ... touch avn-file3.txt git add avn-file3.txt git commit -m "avn-file3.txt"
And periodically push them to the server.
At some point, the decision is made that the "hour X" has arrived and you can publish the project at the customer. Development stops, the contractor’s avn repository has a history of commits:
pick fdf9508 avn-file1.txt pick 0633d9c avn-file2.txt pick 4d71f77 avn-file3.txt
Phase 2. Creating your own repository based on the contractor's repository
We clone the contractor's repository and rewrite origin to the address of our own repository (edit the file /.git/config - well, or in a competent way: via git remote set-url origin <сервер заказчика> ), then git push -f .
We get an absolutely exact copy of the contractor's repository on our own server, with full preservation of the history and even SHA-1 commits will coincide:
pick fdf9508 avn-file1.txt pick 0633d9c avn-file2.txt pick 4d71f77 avn-file3.txt
We proceed to the next phase.
Phase 3. The customer performs some modifications at his own discretion and without regard for the former contractor.
Well, let's say, again, we create several commits:
touch fcs-file1.txt git add fcs-file1.txt git commit -m "fcs-file1.txt" ... touch fcs-file3.txt git add fcs-file3.txt git commit -m "fcs-file3.txt"
And we will periodically push them to our own server. (In reality, fcs is a bare-repository on a server that several developers at the client company have inclined to their workstations, but this is not critical for the test.)
We get this story on our server:
pick fdf9508 avn-file1.txt pick 0633d9c avn-file2.txt pick 4d71f77 avn-file3.txt pick 7dd4772 fcs-file1.txt pick f33cdda fcs-file2.txt pick c54c562 fcs-file3.txt
(The first three commits are those made by the contractor once, the next three are already the customer. The contractor still has only three commits in his repository)
And here at some point, the customer remembers about the contractor and gives him some task for revision. Further interaction proceeds according to the following scheme: a) the contractor takes away the changes made by the customer after the project is completed; b) the contractor makes some improvements in his repository; c) the customer takes the improvements to his server.
So, let's go:
Phase 4. Contractor picks up changes made by the customer
The contractor has some kind of employee responsible for integration, say, Vasya or Petya. Vasya in the avn repository (on his machine) connects the remote repository fcs and calls it (suddenly) just like fcs:
git remote add fcs <адрес репозитория подрядчика>
And from time to time, the master can make changes into his branch that have been made by the customer (at once, do not waste time on fetch + merge):
[vasya@wrkst1 avn]$ git pull fcs master remote: Counting objects: 7, done. remote: Compressing objects: 100% (6/6), done. remote: Total 6 (delta 2), reused 0 (delta 0) Unpacking objects: 100% (6/6), done. From gitserver:polygon/fcs * branch master -> FETCH_HEAD Updating 4d71f77..c54c562 Fast-forward fcs-file1.txt | 0 fcs-file2.txt | 0 fcs-file3.txt | 0 3 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 fcs-file1.txt create mode 100644 fcs-file2.txt create mode 100644 fcs-file3.txt
And on the server of the contractor the same 6 commits appear as for the customer with the same SHA-1.
Phase 5. Contractor doing some refinement
touch avn-megafix1.txt git add avn-megafix1.txt git commit -m "avn-megafix1.txt"
He tests, pours into his repository, informs the person responsible for integration on the part of the customer, so that he takes over the modifications.
Phase 6. The customer takes the changes to his repository.
In principle, the actions are symmetrical to step 4: the person responsible for integration at the customer connects a remote repository avn to his copy of the fcs repository:
git remote add avn <адрес репозитория подрядчика>
And after that it can pick up changes from the server of the contractor:
git pull avn master
Getting exactly the same commits, with the same SHA-1 IDs as the contractor.
Basically, that's all in general terms. Indeed, nothing complicated - the main thing is that the servers are available.