You should look into the HTML5 Sandbox options. While these are not supported in all browsers, they can be helpful to restrict certain actions the attacker might take, such as redirecting the user (replacing your page) rather than being contained in the iframe.
Ideally, you only allow such redirection or iframing to your Partner, and not to 'any random site'. Less-tech-savvy users are more easily tricked into downloading malware from tricky malicious sites. If you only allow a select set of sites (i.e. just partners as you say) then you are less likely to be accidentally guiding users to such tricksters.
@paj28 makes an excellent comment:
With an iframe, the browser address bar still shows your site, so if an external site asked for a password, users would think they're telling your site the password, when in reality they're telling the external site.
This does not affect the Remember Password feature of the browser, but @paj28 is correct that users may not realize the presense of an iframe at all.
I would suggest that a header bar above the iframe be visible to clearly indicate that the visitor is on someone else's site, and to give them a convenient way to return to the safety of a page on your site.
As for redirect, while the URL bar would show the destination site (unlike iframe), it also gives the destination site full control of the site display (you can't include a header bar) so that might make it easier for them to phish the user's password, as many users rely on visual cues (i.e. an official looking header & logo) more than the URL bar.
Finally, I'd point out that well-known sites, before redirecting a user away, would provide brief announcement that it may be unsafe. I personally find such notifications annoying, but it may help from a security standpoint.