Give providers and partners a login that shows only their own slice.
Instead of emailing tokens and stats around, you give each traffic provider (and partner) their own login. The portal is a strictly self-scoped surface: it resolves the caller from their account, never from an id in a URL, so there's nothing to tamper with.
The portal needs no module grants — every response is self-scoped by construction. A user with no linked provider simply sees nothing there, so internal staff and partner accounts are unaffected. Assign the traffic_provider or partner role and the right portal lights up.