There is no "best practice" for this. This requires a risk assessment.
Risk assessments look at the impact of having one setting or another in context, with a defined threat model.
You have several contexts to consider:
admin users and senior management have greater risks with their accounts
how exposed is your corporate network to unauthorised people?
What is a repeatable pattern for Vendor 2 to secure this type of content upload against malware threats?
Assuming you are looking to secure blob from data not uploaded by you. You may use free online service to upload the file temporarily then use virus total like service and call an API to fetch uploaded files from URL and scan for examination by virus ...