I would recommend asking them to setup a meeting between your company, their company, and their qualified security assessors (QSA). It sounds like they are worried about some of the requirements in Section 12 of the DSS(See the Reporting Instructions for Details).
Depending on what you will actually be doing may affect the scope. The company may also be overly cautious. If they properly isolated their PCI data into a "card island" and you are not dealing with payment info, your services should not be in scope. The devil will be in the details, if you expand your question I will try to focus and provide more relevant references.
Some of the specific clauses from the DSS which are relevant here are as follows:
12.1 Examine the information security policy and verify that the policy is published and disseminated to all relevant personnel (including vendors and business partners).
12.8 If the entity shares cardholder data with service providers (for example, back-up tape storage facilities, managed service providers such as Web hosting companies or security service providers, or those that receive data for fraud modeling purposes), through observation, review of policies and procedures, and review of supporting documentation, perform the following:
...
12.8.2 Maintain a written agreement that includes an acknowledgement
that the service providers are responsible for the security of cardholder data the service providers possess.
...
12.8.3 Ensure there is an established process for engaging service providers
including proper due diligence prior to engagement.
...