I am using a third party (Company X) service for a part of my app (Django based) which is behind a secure login. The content from X is delivered in an iframe that is simply embedded in one of my pages.

I have spent a lot of time building the custom content in X's app (it is a custom, interactive geology tool) and my subscription with X is pricey as well. I want to protect against the possibility of one of my users sharing the iframe link with other coworkers or even users in other companies and simply using my content from X without even having to log into my app.

Unfortunately, X has no way to limit the iframe content by IP or any other type of link security. I know, sounds crazy but that's the way it is right now. 

What would be the best way to build my own security solution? Is there a way to use another server as an intermediary so that when the client opens the page my live server hits my intermediary server that fetches the content from X? 
Then, I am the only one to accept requests on my intermediary server from my live server.