My company has a firewall set up which, among other things, scans incoming files for malware. The scanner alerted about a malicious file that was downloaded to one of our machines. After some investigating, I learned that this is a program that is necessary to one of the core functions of our company and needs to be downloaded periodically. Rather than adding the remote IP address as an exception in our firewall's malicious file scanner, I wanted to see if there are general best practices for handling firewall exceptions. It seems like any exception you add is exposing your network to any vulnerability on the remote network.
Is there a widely accepted best practice for deciding whether to add an exception to the firewall versus instead fixing the file or program? If you do end up adding an exception, what are some ways to minimize the possibility that that exception can be exploited?
I'd love any insight on the issue itself, or how the question could be improved. While I'm interested in security, I have very little practical experience with it.