Inhouse business partners VPN

We have an outsourced travel department that has 3 people that work at our facility. They use our intranets web server but that is the only domain resource. I am putting in a Nortel Contivity 100 to allow VPN tunnels back to their application servers. I would like to segment them off the network completely but again, they need to use our intranet. What would be the simplest way of designing this? We have a Cisco 3015, can I create an inbound tunnel that they could come back in on? This might be a firewall nightmare.