I have an Apple Business account, we recently hired a 3rd party company to make us an app. The company requested we create a user account with administrator rights. Do they need "admin" rights to upload an app to the "Custom app" section via testflight ? Other lower permission are available such as People Manager Device Enrollment Manager Content Manager Staff
An account with Administrator rights would be dangerous to give 3rd party people because Administrator accounts have permission like withdrawing the income money etc.
You (or even themselves) can create an account and then you can give App Manager rights to the account, it'd be enough if their job is gonna be only to do the upload process.
They might need your rights while setting the certificates, but other than that, App Manager rights should be alright.