It sounds off that a service provider will not give you details of the product/service you are purchasing. That is like a contractor not telling you what wood he is using to build a house. I would remind your service provider that "security by obscurity" will not help a remote attacker from figuring our or just launching attacks against all versions of SSH.
You should check to see if you have a "right to audit" in your service contract, as that might give you the right to know this information (always try to get such language in your service provider contracts)
Do you have command line/shell access? If you do, you could try to check the version yourself.
In terms of the pen testers getting the wrong version, its entirely possible. Depending on the checks they ran (probably automated through a vulnerability scanner), certain characteristics may not give a 100% match. It's also possible to configure/compile your applications to lie about their versions, change banners, or for some intermediate proxy or load balancer to change this information.
However, it sounds like a red flag from the service provider that they will not release this information. You may want to let them know how important security is to your organization and that lack of sufficient security assurances could lead to taking your business elsewhere.