What NSX Role and Scope should the contractors be given to minimize access but still allow them to fulfill the stated requirement?

An organization has a PCI compliant application deployed as part of a larger NSX environment. Every year a team of contractors evaluates the security of the environment and recommends changes.
What NSX Role and Scope should the contractors be given to minimize access but still allow them to fulfill the stated requirement?
A. NSX Administrator, Limit access scope
B. Enterprise Administrator, Limit access scope
C. Auditor, Limit access scope
D. Security Administrator, No restrictions