I will more-or-less agree with @Julian Knight (+1) and argue that it is a question of balancing cost, convenience and security. It is definitely true that, once information leave your email servers you cannot do anything in terms of protecting it. On the other hand, you do want your contractors to be able to read the emails.
One may argue that deploying your own email system (e.g. by placing Office 365 on top of the exchange server, or even something much simpler such as webpine) instead of simply forwarding email to other email clients will prevent the emails leaving your servers unless the user logins. Yet, when the user does login and sees the email nothing can prevent him from copying and pasting the email text into a text editor.
Therefore there isn't a real security improvement in rolling your own email system instead of providing IMAP or POP3 access, over TLS of course (which isn't the same as forwarding but can be made to work as such with some kind of periodic job). The email text will always end on the computer of the contractor for him to be able to read it.
Moreover, rolling your own system or forcing contractors to use specific clients may be worse in terms of security than using a well defined standard such as STARTTLS - RFC 7812. Not only it may suffer from trivial coding mistakes, but a good contractor may be tempted to find these mistakes to automate his email retrieval.
I'm saying this from personal experience: a company I once worked for required all email users to install an outdated version of Internet Explorer because their email system would not work with a never version. A small python script with a clever User-Agent
and a 10 line JavaScript interpreter did the trick of automated email retrieval.
In summary
Plain forwarding is a bad idea because the email may end on some third party server that is neither under your control or the contractor's control. Yet (in most cases), that does not mean you should allow email access only through approved clients. That is because, unless you plan to invest a big amount of development and audit time to make sure these approved clients will not leak the emails, you're better using well known standards.
And once you allow a contractor to read the emails, you should not be concerned that the emails end on the contractor's computer, they will end there no matter what you do. If the contractor has an email server of his own and wants to use IMAP over TLS to sync his server with yours there isn't much you can do to prevent it. If he gets that mail server compromised it is his fault, and it is not really different from him losing his computer together with company data on it.