Limited Access for Web Developers

We are working with an external web developer in order to add javascript code to one of our landing pages. I don't want to give them full access to our back end, especially not to lists with personal information (GDPR violation). Is there any way to grant limited access to external partners? As far as I know, marketing users are always able to see lists. Any other option?